Snort mailing list archives
Re: WEB-CLIENT Content-Disposition CLSID command attempt(Sig 1:2589) on google ip ranges?
From: "Adam Richards" <adam.richards () ecimln com>
Date: Tue, 10 Nov 2009 14:29:28 -0600
Because of the string AlbumArt_{29D4B86B-D143-4A32-83DA-4E535DADD8BF}_Large.jpg In particular the {29D4B86B-D143-4A32-83DA-4E535DADD8BF} part. Check out http://www.securityfocus.com/archive/1/351379 Adam Richards,CISSP Sr. Systems Engineer General Dynamics IT 1775 Jimmie Davis Hwy Bossier City, LA 71112 318.868.4911 From: Chan, Wilson [mailto:wchan () honolulu gov] Sent: Tuesday, November 10, 2009 2:12 PM To: snort-users () lists sourceforge net Subject: [Snort-users] WEB-CLIENT Content-Disposition CLSID command attempt(Sig 1:2589) on google ip ranges? Anyone have any ideas why Snort is trigger this CLSID rule on google ip ranges? ==Snort Event== <http://pastebin.ca/1665359> http://pastebin.ca/1665359 http://cve.mitre.org/cgi-bin/cvename.cgi?name=2004-0420 http://www.snortid.com/snortid.asp?QueryID=1:2589 These 5 ips owned by google is triggering this alert. 66.102.7.99 72.14.213.91 72.14.213.93 72.14.213.136 72.14.213.190 OrgName: Google Inc. NetRange: 72.14.192.0 - 72.14.255.255 CIDR: 72.14.192.0/18 NetRange: 66.102.0.0 - 66.102.15.255 CIDR: 66.102.0.0/20 NetName: GOOGLE Wilson
Attachment:
smime.p7s
Description:
------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- WEB-CLIENT Content-Disposition CLSID command attempt (Sig 1:2589) on google ip ranges? Chan, Wilson (Nov 10)
- Re: WEB-CLIENT Content-Disposition CLSID command attempt (Sig 1:2589) on google ip ranges? Alex Kirk (Nov 10)
- Re: WEB-CLIENT Content-Disposition CLSID command attempt(Sig 1:2589) on google ip ranges? Adam Richards (Nov 10)