Re: IIS Exploit...

[Brian Caswell <bmc () MITRE ORG>]

Chris Hobbs wrote:
> Well, not too much info here - regrettably my snort rules file got
> zeroed out when whitehats.com changed their format. So, all I have is my
> IIS logs - however, it's pretty straightforward what happened:

YET ANOTHER REASON NOT TO AUTOMAGICLY UPDATE YOUR RULESET!!!!!!!!!

Geez.  I don't know how many times I have to say this.  Automagicly
downloading rulesets for ANYTHING is a very DUMB idea.  If you are
deploying anything like this and you want automagic updates to your
sensors, at LEAST pull your rules from a LOCALLY administrated copy.
And update the LOCAL copy by hand.

-brian