[Emerging-Sigs] [Fwd: SNORT FATAL ERROR]

Michael Scheidell scheidell at secnap.net
Mon Jan 12 22:03:40 EST 2009


> does Accept: need a \: ?
> 
> 
> alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET
> CURRENT_EVENTS Unknown Roundcube Vulnerability Exploit Attempt
> 1"; flow:to_server,established; content:"POST /roundcube/bin/html2text.php
> HTTP/1."; nocase; content:"Accept:
> ZWNobyAoMzMzMjEyKzQzMjQ1NjY2KS4iICI7O3Bhc3N0aHJ1KCJ1bmFtZSAtYTtpZCIpOw==";
> classtype:attempted-admin;
> reference:url,isc.sans.org/diary.html?storyid=5599; sid:2009006; rev:1;)
> 
> 
> -------- Original Message --------
>  Subject:  HackerTrap Alert: FATAL ERROR
>  Date:  Tue, 13 Jan 2009 03:10:58 +0100 (CET)
>  From:  root at success-ae.hackertrap.net (Success-AE Root)
>  To:  maint at success-ae.hackertrap.net
> 
> Jan 13 03:10:58 success-ae snort[43951]: FATAL ERROR:
> rules/emerging.rules(147) => ParsePattern Got Null enclosed in quotation marks
> (")!

-- 
Michael Scheidell, CTO
>|SECNAP Network Security
Winner 2008 Network Products Guide Hot Companies
FreeBSD SpamAssassin Ports maintainer



_________________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r). 
For Information please see http://www.secnap.com/products/spammertrap/
_________________________________________________________________________
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20090112/a6e45cb4/attachment.html


More information about the Emerging-sigs mailing list