#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET EXPLOIT GuppY? error.php POST Arbitrary Remote Code Execution"; flow: to_server,established; content:"POST"; http_method; nocase; content:"/error.php?"; nocase; http_uri; content:"err="; nocase; http_uri; pcre:"/Cookie\:\ +REMOTE_ADDR=/i"; reference:bugtraq,15609; reference:url,doc.emergingthreats.net/bin/view/Main/2003332; classtype:web-application-attack; sid:2003332; rev:5;)

Added 2011-10-12 19:13:17 UTC

#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET EXPLOIT GuppY? error.php POST Arbitrary Remote Code Execution"; flow: to_server,established; content:"POST"; http_method; nocase; content:"/error.php?"; nocase; http_uri; content:"err="; nocase; http_uri; pcre:"/Cookie\:\ +REMOTE_ADDR=/i"; classtype:web-application-attack; reference:bugtraq,15609; reference:url,doc.emergingthreats.net/bin/view/Main/2003332; sid:2003332; rev:5;)

Added 2011-09-14 22:26:14 UTC

#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET EXPLOIT GuppY? error.php POST Arbitrary Remote Code Execution"; flow: to_server,established; content:"POST"; http_method; nocase; content:"/error.php?"; nocase; http_uri; content:"err="; nocase; http_uri; pcre:"/Cookie\:\ +REMOTE_ADDR=/i"; classtype:web-application-attack; reference:bugtraq,15609; reference:url,doc.emergingthreats.net/bin/view/Main/2003332; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/EXPLOIT/EXPLOIT_Guppy; sid:2003332; rev:5;)

Added 2011-02-04 17:22:24 UTC

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET EXPLOIT GuppY? error.php POST Arbitrary Remote Code Execution"; flow: to_server,established; content:"POST "; depth:5; nocase; uricontent:"/error.php?"; nocase; uricontent:"err="; nocase; pcre:"/Cookie\:\ +REMOTE_ADDR=/i"; reference:bugtraq,15609; classtype:web-application-attack; reference:url,doc.emergingthreats.net/bin/view/Main/2003332; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/EXPLOIT/EXPLOIT_Guppy; sid:2003332; rev:4;)

Added 2009-03-13 20:47:17 UTC

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET EXPLOIT GuppY? error.php POST Arbitrary Remote Code Execution"; flow: to_server,established; content:"POST "; depth:5; nocase; uricontent:"/error.php?"; nocase; uricontent:"err="; nocase; pcre:"/Cookie\:\ +REMOTE_ADDR=/i"; reference:bugtraq,15609; classtype:web-application-attack; reference:url,doc.emergingthreats.net/bin/view/Main/2003332; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/EXPLOIT/EXPLOIT_Guppy; sid:2003332; rev:4;)

Added 2009-03-13 20:47:17 UTC

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET EXPLOIT GuppY? error.php POST Arbitrary Remote Code Execution"; flow: to_server,established; content:"POST"; depth:4; nocase; uricontent:"/error.php?"; nocase; uricontent:"err="; nocase; pcre:"/Cookie\:\ +REMOTE_ADDR=/i"; reference:bugtraq,15609; classtype:web-application-attack; reference:url,doc.emergingthreats.net/bin/view/Main/2003332; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/EXPLOIT/EXPLOIT_Guppy; sid:2003332; rev:3;)

Added 2009-02-07 22:00:25 UTC

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET EXPLOIT GuppY? error.php POST Arbitrary Remote Code Execution"; flow: to_server,established; content:"POST"; depth:4; nocase; uricontent:"/error.php?"; nocase; uricontent:"err="; nocase; pcre:"/Cookie\:\ +REMOTE_ADDR=/i"; reference:bugtraq,15609; classtype:web-application-attack; reference:url,doc.emergingthreats.net/bin/view/Main/2003332; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/EXPLOIT/EXPLOIT_Guppy; sid:2003332; rev:3;)

Added 2009-02-07 22:00:25 UTC

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET EXPLOIT GuppY? error.php POST Arbitrary Remote Code Execution"; flow: to_server,established; content:"POST"; depth:4; nocase; uricontent:"/error.php?"; nocase; uricontent:"err="; nocase; pcre:"/Cookie\:\ +REMOTE_ADDR=/i"; reference:bugtraq,15609; classtype:web-application-attack; sid:2003332; rev:2;)

Added 2008-01-25 10:56:37 UTC

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET EXPLOIT GuppY? error.php POST Arbitrary Remote Code Execution"; flow: to_server,established; content:"POST"; depth:4; nocase; uricontent:"/error.php?"; nocase; uricontent:"err="; nocase; pcre:"/Cookie\:\ +REMOTE_ADDR=/i"; reference:bugtraq,15609; classtype:web-application-attack; sid:2003332; rev:2;)

Added 2008-01-25 10:56:37 UTC

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"BLEEDING-EDGE EXPLOIT GuppY? error.php POST Arbitrary Remote Code Execution"; flow: to_server,established; content:"POST"; depth:4; nocase; uricontent:"/error.php?"; nocase; uricontent:"err="; nocase; pcre:"/Cookie\:\ +REMOTE_ADDR=/i"; reference:bugtraq,15609; classtype:web-application-attack; sid:2003332; rev:1;)