alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET CURRENT_EVENTS Vulnerable Aurigma ImageUploader5? ActiveX? CLSID in Use"; flow:from_server,established; content:"CLSID"; nocase; content:"BA162249-F2C5-4851-8ADC-FC58CB424243"; nocase; pcre:"/(%u6950%u74C9|0x40000)/i"; pcre:"/(ExtractIptc?|ExtractExif)/i"; reference:url,www.milw0rm.com/exploits/5049; reference:url,isc.sans.org/diary.html?storyid=3929; classtype:web-application-attack; sid:2007816; rev:3;)

Added 2008-02-16 08:59:47 UTC

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET CURRENT_EVENTS Vulnerable Aurigma ImageUploader5? ActiveX? CLSID in Use"; flow:from_server,established; content:"CLSID"; nocase; content:"BA162249-F2C5-4851-8ADC-FC58CB424243"; nocase; pcre:"/(%u6950%u74C9|0x40000)/i"; pcre:"/(ExtractIptc?|ExtractExif)/i"; reference:url,www.milw0rm.com/exploits/5049; reference:url,isc.sans.org/diary.html?storyid=3929; classtype:web-application-attack; sid:2007816; rev:3;)

Added 2008-02-16 08:59:47 UTC

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET CURRENT_EVENTS Vulnerable Aurigma ImageUploader5? ActiveX? CLSID in Use"; flow:from_server,established; content:"CLSID"; nocase; content:"BA162249-F2C5-4851-8ADC-FC58CB424243"; nocase; pcre:"/(%u6950%u74C9|0x40000)/i"; pcre:"/(ExtractIptc?|ExtractExif)/i"; reference:url,www.milw0rm.com/exploits/5049 reference:url,isc.sans.org/diary.html?storyid=3929; classtype:web-application-attack; sid:2007816; rev:2;)

Added 2008-02-15 11:01:21 UTC

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET CURRENT_EVENTS Vulnerable Aurigma ImageUploader5? ActiveX? CLSID in Use"; flow:from_server,established; content:"CLSID"; nocase; content:"BA162249-F2C5-4851-8ADC-FC58CB424243"; nocase; pcre:"/(%u6950%u74C9|0x40000)/i"; pcre:"/(ExtractIptc?|ExtractExif)/i"; reference:url,www.milw0rm.com/exploits/5049 reference:url,isc.sans.org/diary.html?storyid=3929; classtype:web-application-attack; sid:2007816; rev:2;)

Added 2008-02-15 11:01:21 UTC

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET CURRENT_EVENTS Vulnerable Aurigma ImageUploader5? ActiveX? CLSID in Use"; flow:from_server,established; content:"CLSID"; nocase; content:"BA162249-F2C5-4851-8ADC-FC58CB424243"; nocase; pcre:"/(%u6950%u74C9|0x40000)/i"; pcre:"/(ExtractIptc?|ExtractExif)/i"; reference:url,www.milw0rm.com/exploits/5049 reference:url,isc.sans.org/diary.html?storyid=3929; classtype:web-application-attack; sid:2007816; rev:2;)

Added 2008-02-15 10:59:50 UTC

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET CURRENT_EVENTS Vulnerable Aurigma ImageUploader5? ActiveX? CLSID in Use"; flow:from_server,established; content:"CLSID"; nocase; content:"BA162249-F2C5-4851-8ADC-FC58CB424243"; nocase; pcre:"/(%u6950%u74C9|0x40000)/i"; pcre:"/(ExtractIptc?|ExtractExif)/i"; reference:url,www.milw0rm.com/exploits/5049 reference:url,isc.sans.org/diary.html?storyid=3929; classtype:web-application-attack; sid:2007816; rev:2;)

Added 2008-02-15 10:59:50 UTC

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET CURRENT_EVENTS Vulnerable Aurigma ImageUploader5? ActiveX? CLSID in Use"; flow:from_server,established; content:"CLSID"; nocase; content:"BA162249-F2C5-4851-8ADC-FC58CB424243"; nocase; distance:0; within:40; reference:url,isc.sans.org/diary.html?storyid=3929; classtype:web-application-attack; sid:2007816; rev:1;)

Added 2008-02-05 13:50:04 UTC