RE: FW: CodeRed: the next generation

["Franki" <franki () gshop com au>]

do you think if we asked nicely, they could make a plugin for it to target,
oh I don't know, the taxation office, the government over here....  the list
could be endless..  :-)

don't get me wrong, I don't take it all lightly, I just think the choise of
target is interesting....

the white house is lucky that the worm used a ip address instead of a
domain,, otherwise they would be down for the next 6 months...

rgds

Frank



-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net]On Behalf Of Ryan
Russell
Sent: Saturday, 21 July 2001 3:21 AM
To: Chris Schuler
Cc: 'snort-users () lists sourceforge net'
Subject: Re: [Snort-users] FW: CodeRed: the next generation


On Fri, 20 Jul 2001, Chris Schuler wrote:

> my biggest question is will our existing code red/ida sigs catch CRv2
> ..and does the MS patch work on CRv2

The attack vector is identical, just the payload is a little different.
The signature catches both, and there is only one patch needed.

                                        Ryan


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users