[Emerging-Sigs] Updated Flash Rules

Will Metcalf wmetcalf at emergingthreatspro.com
Wed Dec 12 04:54:22 HAST 2012


Will get them updated thanks!

Regards,

Will

On Wed, Dec 12, 2012 at 7:07 AM, Robert Grabowsky <rgrabowsky at rasecurity.com
> wrote:

> Updated rules Flash Version IE and Mac:
>
> alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY
> Outdated Windows Flash Version IE"; flow:established,to_server;
> content:"x-flash-version|3a 20|"; http_header; content:!"x-flash-version|3a
> 20|11,5,502,135|0d 0a|"; http_header; content:"MSIE"; http_header;
> pcre:"/^User-Agent\x3a[^\r\n]+**?MSIE/Hm"; threshold: type limit, count
> 1, seconds 60, track by_src; reference:url,www.adobe.com/**
> software/flash/about/ <http://www.adobe.com/software/flash/about/>;
> classtype:policy-violation; sid:2014726; rev:15;)
>
>
> alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY
> Outdated Mac Flash Version"; flow:established,to_server;
> content:"x-flash-version|3a| "; http_header; content:!"x-flash-version|3a
> 20|11,5,502,136|0d 0a|"; http_header; content:"Macintosh"; http_header;
> pcre:"/^User-Agent\x3a.+?**Macintosh/Hm"; threshold: type limit, count 1,
> seconds 60, track by_src; classtype:policy-violation; sid:2014727; rev:10;)
>
>
>
>
> ______________________________**_________________
> Emerging-sigs mailing list
> Emerging-sigs at lists.**emergingthreats.net<Emerging-sigs at lists.emergingthreats.net>
> http://lists.emergingthreats.**net/mailman/listinfo/emerging-**sigs<http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs>
>
> Support Emerging Threats! Subscribe to Emerging Threats Pro
> http://www.emergingthreatspro.**com <http://www.emergingthreatspro.com>
> The ONLY place to get complete premium rulesets for Snort 2.4.0 through
> Current!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20121212/95bd55a6/attachment-0001.html>


More information about the Emerging-sigs mailing list