Bleedingsnort.com Daily Update

[***] Results from Oinkmaster started Tue Oct 19 20:00:01 2004 [***]

[+++]          Added rules:          [+++]

     -> Added to bleeding-virus.rules (1):
        alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"BLEEDING-EDGE IRC 
Trojan Reporting LSASS Exploitation"; content:"lsass\: exploit"; 
flow:established,to_server; 
reference:url,www.bleedingsnort.com/forum/viewtopic.php?forum=4&showtopic=85; 
classtype:trojan-activity; sid:2001361; rev:2;)

[---]         Disabled rules:        [---]

     -> Disabled in bleeding-policy.rules (1):
        #alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"BLEEDING-EDGE CHAT 
MSN user search"; flow:to_server,established; content:"CAL "; depth:4; nocase; 
classtype:policy-violation; priority:1; sid:2001244; rev:1;)

     -> Disabled in bleeding.rules (1):
        #alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"BLEEDING-EDGE 
Possible Microsoft asycpict.dll 1.0 Remote JPEG DoS Attack Vulnerability 
Attempt"; content:"|4A 46 49 46|"; content:"|11 08 FF FF FF FF|"; nocase; 
reference:url,archives.neohapsis.com/archives/bugtraq/2004-10/0126.html; 
classtype:attempted-dos; sid:2001360; rev:2;)

[+++]      Added non-rule lines:     [+++]

     -> Added to bleeding-sid-msg.map (1):
        2001361 || BLEEDING-EDGE IRC Trojan Reporting LSASS Exploitation || 
url,www.bleedingsnort.com/forum/viewtopic.php?forum=4&showtopic=85

     -> Added to bleeding-virus.rules (1):
        #Submitted by colforbin5

[---]     Removed non-rule lines:    [---]

     -> Removed from bleeding-sid-msg.map (2):
        2001244 || BLEEDING-EDGE CHAT MSN user search
        2001360 || BLEEDING-EDGE Possible Microsoft asycpict.dll 1.0 Remote 
JPEG DoS Attack Vulnerability Attempt || 
url,archives.neohapsis.com/archives/bugtraq/2004-10/0126.html

[*] Added files: [*]
    None.



-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl