alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER LANDesk Command Injection Attempt"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/gsb/datetime.php"; nocase; http_uri; content:"delBackupName"; nocase; http_client_body; content:"backupRestoreFormSubmitted"; nocase; reference:url,www.coresecurity.com/content/landesk-csrf-vulnerability; reference:cve,2010-0369; reference:url,doc.emergingthreats.net/2010863; classtype:web-application-attack; sid:2010863; rev:7;)

Added 2011-10-12 19:30:46 UTC

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER LANDesk Command Injection Attempt"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/gsb/datetime.php"; nocase; http_uri; content:"delBackupName"; nocase; http_client_body; content:"backupRestoreFormSubmitted"; nocase; classtype:web-application-attack; reference:url,www.coresecurity.com/content/landesk-csrf-vulnerability; reference:cve,2010-0369; reference:url,doc.emergingthreats.net/2010863; sid:2010863; rev:7;)

Added 2011-09-14 22:43:55 UTC

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER LANDesk Command Injection Attempt"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/gsb/datetime.php"; nocase; http_uri; content:"delBackupName"; nocase; http_client_body; content:"backupRestoreFormSubmitted"; nocase; classtype:web-application-attack; reference:url,www.coresecurity.com/content/landesk-csrf-vulnerability; reference:cve,2010-0369; reference:url,doc.emergingthreats.net/2010863; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SERVER/WEB_LANDesk; sid:2010863; rev:7;)

Added 2011-02-04 17:30:32 UTC

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER LANDesk Command Injection Attempt"; content:"POST "; flow:established,to_server; depth:5; nocase; uricontent:"/gsb/datetime.php"; nocase; content:"delBackupName"; nocase; content:"backupRestoreFormSubmitted"; distance:0; nocase; classtype:web-application-attack; reference:url,www.coresecurity.com/content/landesk-csrf-vulnerability; reference:cve,2010-0369; reference:url,doc.emergingthreats.net/2010863; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SERVER/WEB_LANDesk; sid:2010863; rev:3;)

Added 2010-03-11 14:00:52 UTC

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER LANDesk Command Injection Attempt"; content:"POST "; flow:established,to_server; depth:5; nocase; uricontent:"/gsb/datetime.php"; nocase; content:"delBackupName"; nocase; content:"backupRestoreFormSubmitted"; distance:0; nocase; classtype:web-application-attack; reference:url,www.coresecurity.com/content/landesk-csrf-vulnerability; reference:cve,2010-0369; reference:url,doc.emergingthreats.net/2010863; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SERVER/WEB_LANDesk; sid:2010863; rev:3;)

Added 2010-03-11 14:00:52 UTC

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER LANDesk Command Injection Attempt"; content:"POST "; depth:5; nocase; uricontent:"/gsb/datetime.php"; nocase; content:"delBackupName"; nocase; content:"backupRestoreFormSubmitted"; distance:0; nocase; classtype:web-application-attack; reference:url,www.coresecurity.com/content/landesk-csrf-vulnerability; reference:cve,2010-0369; reference:url,doc.emergingthreats.net/2010863; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SERVER/WEB_LANDesk; sid:2010863; rev:2;)

Added 2010-02-28 12:45:48 UTC

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER LANDesk Command Injection Attempt"; content:"POST "; depth:5; nocase; uricontent:"/gsb/datetime.php"; nocase; content:"delBackupName"; nocase; content:"backupRestoreFormSubmitted"; distance:0; nocase; classtype:web-application-attack; reference:url,www.coresecurity.com/content/landesk-csrf-vulnerability; reference:cve,2010-0369; reference:url,doc.emergingthreats.net/2010863; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SERVER/WEB_LANDesk; sid:2010863; rev:2;)

Added 2010-02-28 12:44:06 UTC