RE: Seeing Chuncked content

["Golden_Eternity" <bhodi_jabir () yahoo com>]

I got 43 from 3 sources from the 5th to the 7th, nothing before that. They
triggered on this rule:

alert tcp any any -> any 80 \
(msg: "Apache chunked encoding exploit, n/shh//bi (i.e. /bin/sh)"; \
flags: A+; content: "n/shh//bi";)

Server was patched and happy.



----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com