alert udp $EXTERNAL_NET any -> $HOME_NET 699 (msg:"EXPLOIT RADIUS registration vendor ATTR_TYPE_STR overflow attempt"; flow:to_server; content:"|01|"; depth:1; content:"|01 01 1A|"; depth:3; offset:32; content:"|00 00 15 9F|"; depth:4; offset:36; byte_test:1,>,30,1,relative; isdataat:29,relative; pcre:"/^\x01.{23}(\x25|\x26).{15}(\x0A|\x34)/smi"; reference:bugtraq,12759; reference:cve,2005-0699; reference:nessus,19120; classtype:attempted-admin; sid:3540; rev:4;)alert udp $EXTERNAL_NET any -> $HOME_NET 699 (msg:"EXPLOIT RADIUS ATTR_TYPE_STR overflow attempt"; flow:to_server; content:"|01 01 1A|"; depth:3; offset:28; content:"|00 00 15 9F|"; depth:4; offset:32; byte_test:1,>,30,1,relative; isdataat:29,relative; pcre:"/^(\x03|[\x14-\x17]).{19}(\x25|\x26).{15}(\x0A|\x34)/smi"; reference:bugtraq,12759; reference:cve,2005-0699; reference:nessus,19120; classtype:attempted-admin; sid:3541; rev:4;)alert udp $EXTERNAL_NET any -> $HOME_NET 699 (msg:"EXPLOIT RADIUS MSID overflow attempt"; flow:to_server; content:"|01 01 1F|"; depth:3; offset:28; byte_test:1,>,30,1,relative; isdataat:29,relative; pcre:"/^(\x03|[\x14-\x17]).{19}(\x25|\x26)/smi"; reference:bugtraq,12759; reference:cve,2005-0699; reference:nessus,19120; classtype:attempted-admin; sid:3539; rev:4;)alert udp $EXTERNAL_NET any -> $HOME_NET 699 (msg:"EXPLOIT RADIUS registration MSID overflow attempt"; flow:to_server; content:"|01|"; depth:1; content:"|01 01 1F|"; depth:3; offset:32; byte_test:1,>,30,1,relative; isdataat:29,relative; pcre:"/^\x01.{23}(\x25|\x26)/smi"; reference:bugtraq,12759; reference:cve,2005-0699; reference:nessus,19120; classtype:attempted-admin; sid:3538; rev:4;)alert tcp $EXTERNAL_NET any -> $HOME_NET 10202:10203 (msg:"EXPLOIT Computer Associates license PUTOLF directory traversal attempt"; flow:to_server,established; content:"PUTOLF"; pcre:"/(0x)?[0-9a-f]+\s+PUTOLF\s+((0x[0-9a-f]+)|(0[0-8]+)|([1-9]\d*))\s+\S+\s+\S+\s+((0x[0-9a-f]+)|(0[0-8]+)|([1-9]\d*))\s+\S*\.\.[\x2f\x5c]/i"; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop; reference:bugtraq,12705; reference:cve,2005-0581; classtype:attempted-user; sid:3637; rev:4;)alert tcp $EXTERNAL_NET any -> $HOME_NET 6050 (msg:"EXPLOIT ARCserve backup universal agent option 00 little endian buffer overflow attempt"; flow:to_server,established; content:"|00 00|"; depth:2; offset:256; isdataat:430,relative; byte_test:2,>,679,6,little; byte_test:2,<,1705,6,little; reference:bugtraq,13102; reference:cve,2005-1018; reference:nessus,18041; classtype:attempted-admin; sid:3660; rev:3;)alert tcp $EXTERNAL_NET any -> $HOME_NET 6050 (msg:"EXPLOIT ARCserve backup universal agent option 1000 little endian buffer overflow attempt"; flow:to_server,established; content:"|E8 03|"; depth:2; offset:256; isdataat:430,relative; byte_test:2,>,679,6,little; byte_test:2,<,1705,6,little; reference:bugtraq,13102; reference:cve,2005-1018; reference:nessus,18041; classtype:attempted-admin; sid:3658; rev:3;)alert tcp $EXTERNAL_NET any -> $HOME_NET 514 (msg:"EXPLOIT CVS rsh annotate revision overflow attempt"; flow:to_server,established; content:"|0A|annotate|0A|"; nocase; pcre:"/^Entry \/file\/[0-9.]{71,}\/\/.*\x0aannotate\x0a/smi"; reference:bugtraq,13217; reference:cve,2005-0753; reference:nessus,18097; reference:url,ccvs.cvshome.org/servlets/NewsItemView?newsItemID=141; reference:url,ccvs.cvshome.org/servlets/NewsItemView?newsItemID=142; classtype:attempted-dos; sid:3651; rev:3;)alert tcp $EXTERNAL_NET any -> $HOME_NET 1723 (msg:"EXPLOIT PPTP echo request buffer overflow attempt"; flow:established,to_server; content:"|00 01|"; depth:2; content:"|00 01|"; depth:2; offset:2; content:"|00 05|"; depth:2; offset:8; metadata:policy balanced-ips drop, policy security-ips drop; reference:bugtraq,7316; reference:cve,2003-0213; reference:nessus,11540; reference:url,www.debian.org/security/2003/dsa-295; classtype:attempted-admin; sid:3664; rev:10;)alert tcp $EXTERNAL_NET any -> $HOME_NET 6050 (msg:"EXPLOIT ARCserve backup universal agent option 1000 buffer overflow attempt"; flow:to_server,established; content:"|03 E8|"; depth:2; offset:256; isdataat:430,relative; byte_test:2,>,679,6; byte_test:2,<,1705,6; reference:bugtraq,13102; reference:cve,2005-1018; reference:nessus,18041; classtype:attempted-admin; sid:3659; rev:3;)alert tcp $EXTERNAL_NET any -> $HOME_NET 2401 (msg:"EXPLOIT CVS pserver annotate revision overflow attempt"; flow:to_server,established; content:"|0A|annotate|0A|"; nocase; pcre:"/^Entry \/file\/[0-9.]{71,}\/\/.*\x0aannotate\x0a/smi"; reference:bugtraq,13217; reference:cve,2005-0753; reference:nessus,18097; reference:url,ccvs.cvshome.org/servlets/NewsItemView?newsItemID=141; reference:url,ccvs.cvshome.org/servlets/NewsItemView?newsItemID=142; classtype:attempted-dos; sid:3652; rev:3;)alert tcp $EXTERNAL_NET any -> $HOME_NET 6050 (msg:"EXPLOIT ARCserve backup universal agent option 03 buffer overflow attempt"; flow:to_server,established; content:"|00 03|"; depth:2; offset:256; isdataat:430,relative; byte_test:2,>,679,6; byte_test:2,<,1705,6; reference:bugtraq,13102; reference:cve,2005-1018; reference:nessus,18041; classtype:attempted-admin; sid:3663; rev:3;)alert tcp $EXTERNAL_NET any -> $HOME_NET 6050 (msg:"EXPLOIT ARCserve backup universal agent option 03 little endian buffer overflow attempt"; flow:to_server,established; content:"|03 00|"; depth:2; offset:256; isdataat:430,relative; byte_test:2,>,679,6,little; byte_test:2,<,1705,6,little; reference:bugtraq,13102; reference:cve,2005-1018; reference:nessus,18041; classtype:attempted-admin; sid:3662; rev:3;)alert tcp $EXTERNAL_NET any -> $HOME_NET 6050 (msg:"EXPLOIT ARCserve backup universal agent option 00 buffer overflow attempt"; flow:to_server,established; content:"|00 00|"; depth:2; offset:256; isdataat:430,relative; byte_test:2,>,679,6; byte_test:2,<,1705,6; reference:bugtraq,13102; reference:cve,2005-1018; reference:nessus,18041; classtype:attempted-admin; sid:3661; rev:3;)alert udp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"EXPLOIT Ethereal SIP UDP CSeq overflow attempt"; flow:to_server; content:"CSeq|3A|"; nocase; isdataat:16,relative; content:!"|0A|"; within:16; pcre:"/^CSeq\x3A\s*[^\nA-Za-z]*[A-Za-z][^\n]{16,}/smi"; reference:bugtraq,13504; reference:cve,2005-1461; reference:nessus,18986; reference:url,www.ethereal.com/news/item_20050504_01.html; classtype:attempted-dos; sid:3677; rev:6;)alert tcp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"EXPLOIT Ethereal SIP UDP CSeq overflow attempt"; flow:stateless; content:"CSeq|3A|"; nocase; isdataat:16,relative; content:!"|0A|"; within:16; pcre:"/^CSeq\x3A\s*[^\nA-Za-z]*[A-Za-z][^\n]{16,}/smi"; reference:bugtraq,13504; reference:cve,2005-1461; reference:nessus,18986; reference:url,www.ethereal.com/news/item_20050504_01.html; classtype:attempted-dos; sid:3678; rev:5;)alert tcp $EXTERNAL_NET any -> $HOME_NET 10000 (msg:"EXPLOIT Veritas Backup Agent password overflow attempt"; flow:to_server,established; content:"|00 00 09 01|"; depth:4; offset:16; content:"|00 00 00 03|"; depth:4; offset:28; byte_jump:4,32; byte_test:4,>,1023,0,relative; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop; reference:cve,2005-0773; classtype:attempted-admin; sid:3695; rev:3;)alert tcp $EXTERNAL_NET any -> $HOME_NET 10000 (msg:"EXPLOIT Veritas Backup Agent DoS attempt"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; offset:12; byte_test:4,>,0,24; reference:bugtraq,14201; reference:cve,2005-0772; classtype:attempted-dos; sid:3696; rev:1;)alert tcp $EXTERNAL_NET any -> $HOME_NET [8008,8028] (msg:"EXPLOIT Novell eDirectory Server iMonitor overflow attempt"; flow:to_server,established; content:"/nds/"; pcre:"/\x2fnds\x2f[^&\r\n\x3b]{500}/smi"; reference:bugtraq,14548; reference:cve,2005-2551; classtype:attempted-admin; sid:4127; rev:2;)alert tcp $EXTERNAL_NET any -> $HOME_NET 10000 (msg:"EXPLOIT Veritas Backup Exec root connection attempt using default password hash"; flow:to_server,established; content:"|00 00 00 00 00 00 09 01|"; depth:8; offset:12; content:"|00 00 00 02|"; depth:4; offset:28; content:"root"; depth:4; offset:36; nocase; content:"|B4 B8 0F|& |5C|B4|03 FC AE EE 8F 91|=o"; distance:0; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop; reference:bugtraq,14551; classtype:suspicious-login; sid:4126; rev:3;)alert tcp $EXTERNAL_NET any -> $HOME_NET 1761 (msg:"EXPLOIT Novell ZenWorks Remote Management Agent large login packet DoS attempt"; flow:to_server,established; content:"|00 01|"; depth:2; offset:16; byte_jump:2,0,relative; byte_jump:2,0,relative; byte_test:2,>,1499,0,relative; metadata:policy balanced-ips drop, policy security-ips drop; reference:bugtraq,13678; reference:cve,2005-1543; classtype:attempted-dos; sid:4129; rev:3;)alert tcp $EXTERNAL_NET any -> $HOME_NET 1761 (msg:"EXPLOIT Novell ZenWorks Remote Management Agent buffer overflow Attempt"; flow:to_server,established; content:"|00 01|"; depth:2; offset:16; byte_jump:2,0,relative; byte_jump:2,0,relative; byte_jump:2,0,relative; content:"|00 01 00 01 00 02|"; within:6; isdataat:30,relative; byte_test:2,>,28,0,relative; metadata:policy balanced-ips drop, policy security-ips drop; reference:bugtraq,13678; reference:cve,2005-1543; classtype:attempted-dos; sid:4130; rev:4;)alert tcp $EXTERNAL_NET any -> $HOME_NET 8000 (msg:"EXPLOIT SHOUTcast URI format string attempt"; flow:established,to_server; content:"/content/"; nocase; pcre:"/\/content\/[^\r\n\x20]*\x25[^\r\n\x20]*\x2emp3/smi"; metadata:policy balanced-ips drop, policy security-ips drop; reference:bugtraq,12096; reference:cve,2004-1373; classtype:web-application-attack; sid:4131; rev:3;)# alert tcp $EXTERNAL_NET any -> $HOME_NET 515 (msg:"EXPLOIT lpd Solaris control file upload attempt"; flow:to_server,established; flowbits:isset,lp.cascade; content:"|02|"; depth:1; content:"cfA"; nocase; pcre:"/^\x02\d+ cfA/smi"; flowbits:set,lp.controlfile; classtype:misc-attack; sid:4144; rev:3;)alert udp $EXTERNAL_NET any -> $HOME_NET 500 (msg:"EXPLOIT ISAKMP fifth payload certificate request length overflow attempt"; flow:to_server; byte_test:4,>,2043,24; byte_jump:2,30; byte_jump:2,-2,relative; byte_jump:2,-2,relative; content:"|07|"; within:1; distance:-4; byte_jump:2,1,relative; byte_test:2,>,2043,-2,relative; metadata:policy security-ips drop; reference:bugtraq,9582; reference:cve,2004-0040; classtype:attempted-admin; sid:2380; rev:6;)alert udp $EXTERNAL_NET any -> $HOME_NET 500 (msg:"EXPLOIT ISAKMP forth payload certificate request length overflow attempt"; flow:to_server; byte_test:4,>,2043,24; byte_jump:2,30; byte_jump:2,-2,relative; content:"|07|"; within:1; distance:-4; byte_jump:2,1,relative; byte_test:2,>,2043,-2,relative; metadata:policy security-ips drop; reference:bugtraq,9582; reference:cve,2004-0040; classtype:attempted-admin; sid:2379; rev:6;)# alert tcp $EXTERNAL_NET any -> $HOME_NET 515 (msg:"EXPLOIT lpd receive printer job cascade adaptor protocol request"; flow:to_server,established; content:"|02|"; depth:1; pcre:"/\x02[^\x0a]+\x3a[^\x0a]+\x0a/"; flowbits:set,lp.cascade; flowbits:noalert; classtype:protocol-command-decode; sid:4143; rev:4;)alert udp $EXTERNAL_NET any -> $HOME_NET 500 (msg:"EXPLOIT ISAKMP third payload certificate request length overflow attempt"; flow:to_server; byte_test:4,>,2043,24; byte_jump:2,30; content:"|07|"; within:1; distance:-4; byte_jump:2,1,relative; byte_test:2,>,2043,-2,relative; metadata:policy security-ips drop; reference:bugtraq,9582; reference:cve,2004-0040; classtype:attempted-admin; sid:2378; rev:6;)# alert tcp $EXTERNAL_NET any -> $HOME_NET 3632 (msg:"EXPLOIT Ethereal Distcc SERR buffer overflow attempt"; flow:stateless; content:"SERR"; nocase; byte_test:8,>,2147483647,0,relative,string,hex; reference:url,www.ethereal.com/news/item_20050504_01.html; classtype:attempted-dos; sid:4640; rev:1;)# alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT RSVP Protocol zero length object DoS attempt"; ip_proto:46; content:"|01|"; depth:1; offset:11; byte_test:1,<,4,13; pcre:"/^.{10}[\x14\x15]\x01.{1}[\x00-\x03]/sm"; reference:url,www.frsirt.com/english/advisories/2005/0411; classtype:attempted-dos; sid:4638; rev:4;)# alert tcp $EXTERNAL_NET any -> $HOME_NET 3632 (msg:"EXPLOIT Ethereal Distcc ARGV buffer overflow attempt"; flow:stateless; content:"ARGV"; nocase; byte_test:8,>,2147483647,0,relative,string,hex; reference:url,www.ethereal.com/news/item_20050504_01.html; classtype:attempted-dos; sid:4639; rev:1;)# alert tcp $EXTERNAL_NET any -> $HOME_NET 8080 (msg:"EXPLOIT MailEnable HTTPMail buffer overflow attempt"; flow:to_server,established; content:"GET"; content:"Authorization|3A|"; nocase; isdataat:261,relative; content:!"|0D 0A|"; within:261; metadata:policy balanced-ips drop, policy security-ips drop; reference:bugtraq,13350; reference:url,www.frsirt.com/english/advisories/2005/0383; classtype:attempted-admin; sid:4637; rev:5;)# alert tcp $EXTERNAL_NET any -> $HOME_NET 3632 (msg:"EXPLOIT Ethereal Distcc SOUT buffer overflow attempt"; flow:stateless; content:"SOUT"; nocase; byte_test:8,>,2147483647,0,relative,string,hex; reference:url,www.ethereal.com/news/item_20050504_01.html; classtype:attempted-dos; sid:4641; rev:1;)alert tcp $EXTERNAL_NET any -> $HOME_NET 5631 (msg:"EXPLOIT pcAnywhere buffer overflow attempt"; flow:established,to_server; content:"o"; depth:1; byte_test:1,>,96,1; byte_test:1,<,101,1; byte_test:2,>,512,3; isdataat:510,relative; reference:bugtraq,15646; reference:cve,2005-3934; classtype:attempted-dos; sid:5317; rev:1;)alert tcp $EXTERNAL_NET any -> $HOME_NET 4105 (msg:"EXPLOIT CA CAM log_security overflow attempt"; flow:to_server,established; content:"|FA F9 00 10|"; isdataat:1025; content:!"|00|"; within:1021; reference:bugtraq,14622; reference:cve,2005-2668; classtype:misc-attack; sid:5316; rev:2;)alert tcp $EXTERNAL_NET any -> $HOME_NET 13724 (msg:"EXPLOIT VERITAS NetBackup vnetd connection attempt"; flow:to_server,established; content:"6|00|bpspsserver|00|"; flowbits:set,vnetd.bpspsserver.connection; flowbits:noalert; classtype:protocol-command-decode; sid:6010; rev:2;)alert tcp $EXTERNAL_NET any -> $HOME_NET 13724 (msg:"EXPLOIT VERITAS NetBackup vnetd buffer overflow attempt"; flow:to_server,established; flowbits:isset,vnetd.bpspsserver.connection; byte_test:4,>,1024,0; isdataat:1024; flowbits:unset,vnetd.bpspsserver.connection; reference:bugtraq,17264; reference:cve,2006-0991; classtype:attempted-admin; sid:6011; rev:1;)alert tcp $EXTERNAL_NET any -> $HOME_NET 13701 (msg:"EXPLOIT Veritas NetBackup Volume Manager connection attempt"; flow:to_server,established; byte_test:1,>,3,10,dec,string; byte_test:1,<,11,10,dec,string; flowbits:set,veritas.vmd.connect; flowbits:noalert; classtype:protocol-command-decode; sid:6404; rev:2;)alert tcp $EXTERNAL_NET any -> $HOME_NET 13701 (msg:"EXPLOIT Veritas NetBackup Volume Manager overflow attempt"; flow:to_server,established; flowbits:isset,veritas.vmd.connect; pcre:"/(0x[0-9a-f]+|0[0-8]+|[1-9]\d*)\s+\S{157}|(0x[0-9a-f]+|0[0-8]+|[1-9]\d*)\s+\S+\s+\S{125}|(0x[0-9a-f]+|0[0-8]+|[1-9]\d*)\s+\S+\s+\S+\s+\S{1025}|(0x[ 0-9a-f]+|0[0-8]+|[1-9]\d*)\s+\S+\s+\S+\s+\S+\s+\S{117}|(0x[0-9a-f]+|0[0-8]+|[1-9]\d*)\s+\S+\s+\S+\s+\S+\s+\S+\s+\S{37}/i"; reference:bugtraq,17264; reference:cve,2006-0989; classtype:attempted-admin; sid:6405; rev:1;)# alert tcp $EXTERNAL_NET any -> $HOME_NET 5900 (msg:"EXPLOIT RealVNC password authentication bypass vulnerability attempt"; flow:to_server,established; flowbits:isset,vnc.server.auth.types; dsize:1; content:"|01|"; flowbits:unset,vnc.server.connection; flowbits:unset,vnc.server.auth.types; reference:bugtraq,17978; reference:cve,2006-2369; classtype:attempted-admin; sid:6471; rev:2;)# alert tcp $HOME_NET 5900 -> $EXTERNAL_NET any (msg:"EXPLOIT RealVNC authentication types sent attempt"; flow:to_client,established; flowbits:isset,vnc.server.connection; isdataat:4; pcre:"/^[\x00-\x03][^\x01]{1,3}/"; flowbits:set,vnc.server.auth.types; flowbits:noalert; classtype:protocol-command-decode; sid:6470; rev:3;)# alert tcp $HOME_NET 5900 -> $EXTERNAL_NET any (msg:"EXPLOIT RealVNC connection attempt"; flow:to_client,established; isdataat:12; content:"RFB"; depth:3; flowbits:set,vnc.server.connection; flowbits:noalert; classtype:protocol-command-decode; sid:6469; rev:3;)alert tcp $EXTERNAL_NET any -> $HOME_NET 2967 (msg:"EXPLOIT symantec antivirus realtime virusscan overflow attempt"; flow:to_server,established; byte_test:1,=,1,0; byte_test:1,=,10,4; byte_test:2,=,36,16; byte_jump:2,32; byte_test:1,!,0,0,relative; reference:bugtraq,18107; reference:cve,2006-2630; classtype:attempted-admin; sid:6512; rev:1;)alert tcp $EXTERNAL_NET any -> $HOME_NET 497 (msg:"EXPLOIT EMC retrospect client crafted packet overflow attempt"; flow:to_server,established; content:"h"; depth:1; offset:1; byte_test:4,>,36,4; reference:bugtraq,17948; reference:cve,2006-2391; classtype:attempted-admin; sid:6508; rev:1;)