alert tcp $EXTERNAL_NET 1863 -> $HOME_NET any (msg:"EXPLOIT MSN Messenger png overflow"; flow:to_client,established; content:"application/x-msnmsgrp2p"; nocase; content:"|89|PNG|0D 0A 1A 0A|"; distance:0; content:"IHDR"; within:4; distance:4; content:"|03|"; within:1; distance:9; content:"tRNS"; distance:0; byte_test:4,>,256,-8,relative,big; reference:bugtraq,10872; reference:cve,2004-0957; reference:url,www.microsoft.com/technet/security/bulletin/MS05-009.mspx; classtype:attempted-user; sid:3130; rev:3;)alert udp $EXTERNAL_NET any -> $HOME_NET 42 (msg:"EXPLOIT WINS name query overflow attempt UDP"; byte_test:1,&,64,2; content:" "; offset:12; isdataat:56,relative; reference:bugtraq,9624; reference:cve,2003-0825; reference:url,www.microsoft.com/technet/security/bulletin/MS04-006.mspx; classtype:attempted-admin; sid:3200; rev:3;)alert tcp $EXTERNAL_NET any -> $HOME_NET 617 (msg:"EXPLOIT Arkeia backup client type 84 overflow attempt"; flow:established,to_server; content:"|00|T"; depth:2; byte_test:2,>,255,6; isdataat:263; content:!"|00|"; depth:255; offset:8; reference:bugtraq,12594; classtype:attempted-user; sid:3458; rev:2;)alert tcp $EXTERNAL_NET any -> $HOME_NET 5001 (msg:"EXPLOIT Bontago Game Server Nickname Buffer Overflow"; flow:to_server,established; content:"|FF 01 00 00 00 00 01|"; isdataat:512,relative; reference:bugtraq,12603; reference:url,aluigi.altervista.org/adv/bontagobof-adv.txt; classtype:attempted-user; sid:3455; rev:2;)alert tcp $EXTERNAL_NET any -> $HOME_NET 42 (msg:"EXPLOIT WINS name query overflow attempt TCP"; flow:established; byte_test:1,&,64,2; content:" "; offset:12; isdataat:56,relative; reference:bugtraq,9624; reference:cve,2003-0825; reference:url,www.microsoft.com/technet/security/bulletin/MS04-006.mspx; classtype:attempted-admin; sid:3199; rev:3;)alert tcp $EXTERNAL_NET any -> $HOME_NET 617 (msg:"EXPLOIT Arkeia backup client type 77 overflow attempt"; flow:established,to_server; content:"|00|M"; depth:2; byte_test:2,>,23,6; isdataat:31; content:!"|00|"; depth:23; offset:8; reference:bugtraq,12594; classtype:attempted-user; sid:3457; rev:2;)# alert tcp $EXTERNAL_NET any -> $HOME_NET 41523 (msg:"EXPLOIT ARCserve backup TCP slot info msg client domain overflow"; flow:to_server,established; content:"|98|"; depth:1; isdataat:40; content:!"|00|"; depth:16; offset:24; reference:bugtraq,12563; classtype:attempted-admin; sid:3475; rev:2;)# alert udp $EXTERNAL_NET any -> $HOME_NET 41524 (msg:"EXPLOIT ARCserve backup UDP product info msg 0x9c client domain overflow"; content:"|9C|"; depth:1; isdataat:41; content:!"|00|"; depth:16; offset:25; reference:bugtraq,12563; classtype:attempted-admin; sid:3485; rev:3;)# alert tcp $EXTERNAL_NET any -> $HOME_NET 41523 (msg:"EXPLOIT ARCserve backup TCP product info msg 0x9c client name overflow"; flow:to_server,established; content:"|9C|"; depth:1; isdataat:17; content:!"|00|"; depth:16; offset:1; reference:bugtraq,12563; classtype:attempted-admin; sid:3479; rev:2;)# alert udp $EXTERNAL_NET any -> $HOME_NET 41524 (msg:"EXPLOIT ARCserve discovery service overflow"; dsize:>966; reference:bugtraq,12491; reference:can,2005-0260; classtype:attempted-admin; sid:3472; rev:2;)# alert udp $EXTERNAL_NET any -> $HOME_NET 41524 (msg:"EXPLOIT ARCserve backup UDP product info msg 0x9c client name overflow"; content:"|9C|"; depth:1; isdataat:17; content:!"|00|"; depth:16; offset:1; reference:bugtraq,12563; classtype:attempted-admin; sid:3484; rev:2;)# alert tcp $EXTERNAL_NET any -> $HOME_NET 41523 (msg:"EXPLOIT ARCserve backup TCP product info msg 0x9b client domain overflow"; flow:to_server,established; content:"|9B|"; depth:1; isdataat:40; content:!"|00|"; depth:16; offset:24; reference:bugtraq,12563; classtype:attempted-admin; sid:3476; rev:2;)# alert udp $EXTERNAL_NET any -> $HOME_NET 41524 (msg:"EXPLOIT ARCserve backup UDP slot info msg client domain overflow"; content:"|98|"; depth:1; isdataat:41; content:!"|00|"; depth:16; offset:25; reference:bugtraq,12563; classtype:attempted-admin; sid:3481; rev:3;)# alert udp $EXTERNAL_NET any -> $HOME_NET 41524 (msg:"EXPLOIT ARCserve backup UDP product info msg 0x9b client domain overflow"; content:"|9B|"; depth:1; isdataat:41; content:!"|00|"; depth:16; offset:25; reference:bugtraq,12563; classtype:attempted-admin; sid:3483; rev:3;)# alert tcp $EXTERNAL_NET any -> $HOME_NET 41523 (msg:"EXPLOIT ARCserve backup TCP product info msg 0x9b client name overflow"; flow:to_server,established; content:"|9B|"; depth:1; isdataat:17; content:!"|00|"; depth:16; offset:1; reference:bugtraq,12563; classtype:attempted-admin; sid:3477; rev:2;)# alert udp $EXTERNAL_NET any -> $HOME_NET 41524 (msg:"EXPLOIT ARCserve backup UDP slot info msg client name overflow"; content:"|98|"; depth:1; isdataat:17; content:!"|00|"; depth:16; offset:1; reference:bugtraq,12563; classtype:attempted-admin; sid:3480; rev:2;)# alert tcp $EXTERNAL_NET any -> $HOME_NET 41523 (msg:"EXPLOIT ARCserve backup TCP slot info msg client name overflow"; flow:to_server,established; content:"|98|"; depth:1; isdataat:17; content:!"|00|"; depth:16; offset:1; reference:bugtraq,12563; classtype:attempted-admin; sid:3474; rev:2;)# alert udp $EXTERNAL_NET any -> $HOME_NET 41524 (msg:"EXPLOIT ARCserve backup UDP product info msg 0x9b client name overflow"; content:"|9B|"; depth:1; isdataat:17; content:!"|00|"; depth:16; offset:1; reference:bugtraq,12563; classtype:attempted-admin; sid:3482; rev:2;)# alert tcp $EXTERNAL_NET any -> $HOME_NET 41523 (msg:"EXPLOIT ARCserve backup TCP product info msg 0x9c client domain overflow"; flow:to_server,established; content:"|9C|"; depth:1; isdataat:40; content:!"|00|"; depth:16; offset:24; reference:bugtraq,12563; classtype:attempted-admin; sid:3478; rev:2;)alert udp $EXTERNAL_NET any -> $HOME_NET 699 (msg:"EXPLOIT RADIUS registration vendor ATTR_TYPE_STR overflow attempt"; content:"|01|"; depth:1; content:"|01 01 1A|"; depth:3; offset:32; content:"|00 00 15 9F|"; depth:4; offset:36; byte_test:1,>,30,1,relative; isdataat:29,relative; pcre:"/^\x01.{23}(\x25|\x26).{15}(\x0A|\x34)/smi"; reference:bugtraq,12759; reference:cve,2005-0699; classtype:attempted-admin; sid:3540; rev:2;)alert tcp $EXTERNAL_NET any -> $HOME_NET 515 (msg:"EXPLOIT Solaris LPD overflow attempt"; flow:to_server,established; content:"|02|//////////"; depth:11; dsize:>1000; threshold:type limit,track by_dst,count 5,seconds 60; reference:bugtraq,3274; classtype:attempted-admin; sid:3527; rev:2;)alert tcp $EXTERNAL_NET any -> $HOME_NET 10202:10203 (msg:"EXPLOIT Computer Associates license GCR CHECKSUMS overflow attempt"; flow:to_server,established; content:"GCR CHECKSUMS<"; depth:14; offset:3; nocase; pcre:"/(0x)?[0-9a-f]+\s+\S{65}|(0x)?[0-9a-f]+\s+\S+\s+(0x[0-9a-f]+)|(0[0-8]+)|([1-9]\d*)\s+(0x)?[0-9a-f]+\s+\S{65}|(0x)?[0-9a-f]+\s+\S+\s+(0x[0-9a-f]+)|(0[0-8]+)|([1-9]\d*)\s+(0x)?[0-9a-f]+\s+\S+\s+(0x[0-9a-f]+)|(0[0-8]+)|([1-9]\d*)\s+(0x)?[0-9a-f]+\s+\S{65}|(0x)?[0-9a-f]+\s+\S+\s+(0x[0-9a-f]+)|(0[0-8]+)|([1-9]\d*)\s+(0x)?[0-9a-f]+\s+\S+\s+(0x[0-9a-f]+)|(0[0-8]+)|([1-9]\d*)\s+(0x)?[0-9a-f]+\s+\S+\s+(0x[0-9a-f]+)|(0[0-8]+)|([1-9]\d*)\s+(0x)?[0-9a-f]+\s+\S{65}/Ri"; reference:bugtraq,12705; reference:cve,2005-0581; classtype:attempted-user; sid:3521; rev:3;)# alert udp $EXTERNAL_NET any -> $HOME_NET 41524 (msg:"EXPLOIT ARCserve backup UDP msg 0x99 client domain overflow"; content:"|99|"; depth:1; isdataat:41; content:!"|00|"; depth:16; offset:25; reference:bugtraq,12563; classtype:attempted-admin; sid:3531; rev:2;)alert udp $EXTERNAL_NET any -> $HOME_NET 699 (msg:"EXPLOIT RADIUS ATTR_TYPE_STR overflow attempt"; content:"|01 01 1A|"; depth:3; offset:28; content:"|00 00 15 9F|"; depth:4; offset:32; byte_test:1,>,30,1,relative; isdataat:29,relative; pcre:"/^(\x03|[\x14-\x17]).{19}(\x25|\x26).{15}(\x0A|\x34)/smi"; reference:bugtraq,12759; reference:cve,2005-0699; classtype:attempted-admin; sid:3541; rev:2;)alert tcp $EXTERNAL_NET any -> $HOME_NET 10202:10203 (msg:"EXPLOIT Computer Associates license GCR NETWORK overflow attempt"; flow:to_server,established; content:"GCR NETWORK<"; depth:12; offset:3; nocase; pcre:"/^\S{65}|\S+\s+\S{65}|\S+\s+\S+\s+\S{65}/Ri"; reference:bugtraq,12705; reference:cve,2005-0581; classtype:attempted-user; sid:3520; rev:3;)alert tcp $EXTERNAL_NET 10202 -> $HOME_NET any (msg:"EXPLOIT Computer Associates license GETCONFIG client overflow attempt"; flow:from_server,established; content:"GETCONFIG SELF "; depth:15; offset:3; nocase; isdataat:200,relative; content:!"<EOM>"; within:204; reference:bugtraq,12705; reference:cve,2005-0581; classtype:attempted-user; sid:3529; rev:2;)# alert udp $EXTERNAL_NET any -> $HOME_NET 41524 (msg:"EXPLOIT ARCserve backup UDP msg 0x99 client name overflow"; content:"|99|"; depth:1; isdataat:17; content:!"|00|"; depth:16; offset:1; reference:bugtraq,12563; classtype:attempted-admin; sid:3530; rev:2;)alert udp $EXTERNAL_NET any -> $HOME_NET 699 (msg:"EXPLOIT RADIUS MSID overflow attempt"; content:"|01 01 1F|"; depth:3; offset:28; byte_test:1,>,30,1,relative; isdataat:29,relative; pcre:"/^(\x03|[\x14-\x17]).{19}(\x25|\x26)/smi"; reference:bugtraq,12759; reference:cve,2005-0699; classtype:attempted-admin; sid:3539; rev:2;)alert tcp $EXTERNAL_NET any -> $HOME_NET 10202:10203 (msg:"EXPLOIT Computer Associates license invalid GCR NETWORK attempt"; flow:to_server,established; content:"GCR NETWORK<"; depth:12; offset:3; nocase; pcre:!"/^\S+\s+\S+\s+\S+/Ri"; reference:bugtraq,12705; reference:cve,2005-0581; classtype:attempted-dos; sid:3525; rev:2;)alert udp $EXTERNAL_NET any -> $HOME_NET 699 (msg:"EXPLOIT RADIUS registration MSID overflow attempt"; content:"|01|"; depth:1; content:"|01 01 1F|"; depth:3; offset:32; byte_test:1,>,30,1,relative; isdataat:29,relative; pcre:"/^\x01.{23}(\x25|\x26)/smi"; reference:bugtraq,12759; reference:cve,2005-0699; classtype:attempted-admin; sid:3538; rev:2;)alert tcp $EXTERNAL_NET any -> $HOME_NET 10202:10203 (msg:"EXPLOIT Computer Associates license invalid GCR CHECKSUMS attempt"; flow:to_server,established; content:"GCR CHECKSUMS<"; depth:14; offset:3; nocase; pcre:!"/^(0x)?[0-9a-f]+\s+(0x)?[0-9a-f]+\s+(0x)?[0-9a-f]+\s+(0x)?[0-9a-f]+\s+(0x)?[0-9a-f]+\s+(0x)?[0-9a-f]+\s+(0x)?[0-9a-f]+\s+(0x)?[0-9a-f]+\s+(0x)?[0-9a-f]+\s+(0x)?[0-9a-f]+\s+(0x)?[0-9a-f]+\s+(0x)?[0-9a-f]+/Ri"; reference:bugtraq,12705; reference:cve,2005-0581; classtype:attempted-dos; sid:3524; rev:2;)alert tcp $EXTERNAL_NET any -> $HOME_NET 10202:10203 (msg:"EXPLOIT Computer Associates license PUTOLF overflow attempt"; flow:to_server,established; content:"PUTOLF"; depth:6; offset:3; nocase; pcre:"/PUTOLF\s+((\S+\s+){4}[^\s]{256}|(\S+\s+){6}[^\x3c]{512})/i"; reference:bugtraq,12705; reference:cve,2005-0581; classtype:attempted-user; sid:3517; rev:3;)alert tcp $EXTERNAL_NET any -> $HOME_NET 10202 (msg:"EXPLOIT Computer Associates license GETCONFIG server overflow attempt"; flow:to_server,established; content:"GETCONFIG SELF "; depth:15; offset:3; nocase; isdataat:200,relative; content:!"<EOM>"; within:204; reference:bugtraq,12705; reference:cve,2005-0581; classtype:attempted-user; sid:3522; rev:3;)alert tcp $EXTERNAL_NET any -> $HOME_NET 10202:10203 (msg:"EXPLOIT Computer Associates license PUTOLF directory traversal attempt"; flow:to_server,established; content:"PUTOLF"; pcre:"/(0x)?[0-9a-f]+\s+PUTOLF\s+((0x[0-9a-f]+)|(0[0-8]+)|([1-9]\d*))\s+\S+\s+\S+\s+((0x[0-9a-f]+)|(0[0-8]+)|([1-9]\d*))\s+\S*\.\.[\x2f\x5c]/i"; reference:bugtraq,12705; reference:cve,2005-0581; classtype:attempted-user; sid:3637; rev:2;)alert tcp $EXTERNAL_NET any -> $HOME_NET 6050 (msg:"EXPLOIT ARCserve backup universal agent option 00 little endian buffer overflow attempt"; flow:to_server,established; content:"|00 00|"; depth:2; offset:256; isdataat:430,relative; byte_test:2,>,679,6,little; byte_test:2,<,1705,6,little; reference:bugtraq,13102; reference:cve,2005-1018; classtype:attempted-admin; sid:3660; rev:2;)alert tcp $EXTERNAL_NET any -> $HOME_NET 6050 (msg:"EXPLOIT ARCserve backup universal agent option 1000 little endian buffer overflow attempt"; flow:to_server,established; content:"|E8 03|"; depth:2; offset:256; isdataat:430,relative; byte_test:2,>,679,6,little; byte_test:2,<,1705,6,little; reference:bugtraq,13102; reference:cve,2005-1018; classtype:attempted-admin; sid:3658; rev:2;)alert tcp $EXTERNAL_NET any -> $HOME_NET 514 (msg:"EXPLOIT CVS rsh annotate revision overflow attempt"; flow:to_server,established; content:"|0A|annotate|0A|"; nocase; pcre:"/^Entry \/file\/[0-9.]{71,}\/\/.*\x0aannotate\x0a/smi"; reference:bugtraq,13217; reference:cve,2005-0753; reference:url,ccvs.cvshome.org/servlets/NewsItemView?newsItemID=141; reference:url,ccvs.cvshome.org/servlets/NewsItemView?newsItemID=142; classtype:attempted-dos; sid:3651; rev:2;)alert tcp $EXTERNAL_NET any -> $HOME_NET 1723 (msg:"EXPLOIT PPTP echo request buffer overflow attempt"; flow:established,to_server; content:"|00 01|"; depth:2; content:"|00 01|"; depth:2; offset:2; content:"|00 05|"; depth:2; offset:8; reference:bugtaq,7316; reference:cve,2003-0213; classtype:attempted-admin; sid:3664; rev:2;)alert tcp $EXTERNAL_NET any -> $HOME_NET 6050 (msg:"EXPLOIT ARCserve backup universal agent option 1000 buffer overflow attempt"; flow:to_server,established; content:"|03 E8|"; depth:2; offset:256; isdataat:430,relative; byte_test:2,>,679,6; byte_test:2,<,1705,6; reference:bugtraq,13102; reference:cve,2005-1018; classtype:attempted-admin; sid:3659; rev:2;)alert tcp $EXTERNAL_NET any -> $HOME_NET 2401 (msg:"EXPLOIT CVS pserver annotate revision overflow attempt"; flow:to_server,established; content:"|0A|annotate|0A|"; nocase; pcre:"/^Entry \/file\/[0-9.]{71,}\/\/.*\x0aannotate\x0a/smi"; reference:bugtraq,13217; reference:cve,2005-0753; reference:url,ccvs.cvshome.org/servlets/NewsItemView?newsItemID=141; reference:url,ccvs.cvshome.org/servlets/NewsItemView?newsItemID=142; classtype:attempted-dos; sid:3652; rev:2;)alert tcp $EXTERNAL_NET any -> $HOME_NET 6050 (msg:"EXPLOIT ARCserve backup universal agent option 03 buffer overflow attempt"; flow:to_server,established; content:"|00 03|"; depth:2; offset:256; isdataat:430,relative; byte_test:2,>,679,6; byte_test:2,<,1705,6; reference:bugtraq,13102; reference:cve,2005-1018; classtype:attempted-admin; sid:3663; rev:2;)alert tcp $EXTERNAL_NET any -> $HOME_NET 6050 (msg:"EXPLOIT ARCserve backup universal agent option 03 little endian buffer overflow attempt"; flow:to_server,established; content:"|03 00|"; depth:2; offset:256; isdataat:430,relative; byte_test:2,>,679,6,little; byte_test:2,<,1705,6,little; reference:bugtraq,13102; reference:cve,2005-1018; classtype:attempted-admin; sid:3662; rev:2;)alert tcp $EXTERNAL_NET any -> $HOME_NET 6050 (msg:"EXPLOIT ARCserve backup universal agent option 00 buffer overflow attempt"; flow:to_server,established; content:"|00 00|"; depth:2; offset:256; isdataat:430,relative; byte_test:2,>,679,6; byte_test:2,<,1705,6; reference:bugtraq,13102; reference:cve,2005-1018; classtype:attempted-admin; sid:3661; rev:2;)alert udp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"EXPLOIT SIP UDP CSeq overflow attempt"; content:"CSeq|3A|"; nocase; isdataat:16,relative; content:!"|0A|"; within:16; reference:url,www.ethereal.com/news/item_20050504_01.html; classtype:attempted-dos; sid:3677; rev:2;)alert tcp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"EXPLOIT SIP TCP CSeq overflow attempt"; flow:stateless; content:"CSeq|3A|"; nocase; isdataat:16,relative; content:!"|0A|"; within:16; reference:url,www.ethereal.com/news/item_20050504_01.html; classtype:attempted-dos; sid:3678; rev:2;)alert tcp $EXTERNAL_NET any -> $HOME_NET 10000 (msg:"EXPLOIT Veritas Backup Agent password overflow attempt"; flow:to_server,established; content:"|00 00 09 01|"; depth:4; offset:16; content:"|00 00 00 03|"; depth:4; offset:28; byte_jump:4,32; byte_test:4,>,1023,0,relative; reference:cve,2005-0773; classtype:attempted-admin; sid:3695; rev:1;)alert tcp $EXTERNAL_NET any -> $HOME_NET 10000 (msg:"EXPLOIT Veritas Backup Agent DoS attempt"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; offset:12; byte_test:4,>,0,24; reference:bugtraq,14201; reference:cve,2005-0772; classtype:attempted-dos; sid:3696; rev:1;)