alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET CURRENT_EVENTS Aurigma Image Uploader ImageUploader4?.ocx ActiveX? Control Buffer Overflow Attempt"; flow:to_client,established; content:"0x40000"; content:"Action"; nocase; content:"clsid"; nocase; content:"6E5E167B-1566-4316-B27F-0DDAB3484CF7"; nocase; classtype:web-application-attack; reference:bugtraq,27539; reference:url,isc.sans.org/diary.html?storyid=3929; sid:2007815; rev:2;)

Added 2008-02-13 14:02:58 UTC

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET CURRENT_EVENTS Aurigma Image Uploader ImageUploader4?.ocx ActiveX? Control Buffer Overflow Attempt"; flow:to_client,established; content:"0x40000"; content:"Action"; nocase; content:"clsid"; nocase; content:"6E5E167B-1566-4316-B27F-0DDAB3484CF7"; nocase; classtype:web-application-attack; reference:bugtraq,27539; reference:url,isc.sans.org/diary.html?storyid=3929; sid:2007815; rev:2;)

Added 2008-02-13 14:02:58 UTC

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET CURRENT_EVENTS Vulnerable Aurigma ImageUploader4? ActiveX? CLSID in Use"; flow:from_server,established; content:"CLSID"; nocase; content:"6E5E167B-1566-4316-B27F-0DDAB3484CF7"; nocase; distance:0; within:40; reference:url,isc.sans.org/diary.html?storyid=3929; classtype:web-application-attack; sid:2007815; rev:1;)

Added 2008-02-05 13:50:04 UTC