alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT FTP Serv-U Server Long Filename Stack Overflow Vulnerability"; flow: to_server,established; content:"chmod"; nocase; pcre:"/chmod[\s]+([\d]{1,4})*[\s]*[\w\.\/]{250}/Bi"; reference:url,www.securiteam.com/windowsntfocus/5OP0N1PBPG.html; classtype: misc-activity; reference:url,doc.emergingthreats.net/bin/view/Main/2001215; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/EXPLOIT/EXPLOIT_Serv-U_Ftp; sid: 2001215; rev:9;)

Added 2009-02-07 22:00:26 UTC

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT FTP Serv-U Server Long Filename Stack Overflow Vulnerability"; flow: to_server,established; content:"chmod"; nocase; pcre:"/chmod[\s]+([\d]{1,4})*[\s]*[\w\.\/]{250}/Bi"; reference:url,www.securiteam.com/windowsntfocus/5OP0N1PBPG.html; classtype: misc-activity; reference:url,doc.emergingthreats.net/bin/view/Main/2001215; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/EXPLOIT/EXPLOIT_Serv-U_Ftp; sid: 2001215; rev:9;)

Added 2009-02-07 22:00:26 UTC

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT FTP Serv-U Server Long Filename Stack Overflow Vulnerability"; flow: to_server,established; content:"chmod"; nocase; pcre:"/chmod[\s]+([\d]{1,4})*[\s]*[\w\.\/]{250}/Bi"; reference:url,www.securiteam.com/windowsntfocus/5OP0N1PBPG.html; classtype: misc-activity; sid: 2001215; rev:8;)

Added 2008-01-25 10:56:38 UTC

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT FTP Serv-U Server Long Filename Stack Overflow Vulnerability"; flow: to_server,established; content:"chmod"; nocase; pcre:"/chmod[\s]+([\d]{1,4})*[\s]*[\w\.\/]{250}/Bi"; reference:url,www.securiteam.com/windowsntfocus/5OP0N1PBPG.html; classtype: misc-activity; sid: 2001215; rev:8;)

Added 2008-01-25 10:56:38 UTC

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "BLEEDING-EDGE EXPLOIT FTP Serv-U Server Long Filename Stack Overflow Vulnerability"; flow: to_server,established; content:"chmod"; nocase; pcre:"/chmod[\s]+([\d]{1,4})*[\s]*[\w\.\/]{250}/Bi"; reference:url,www.securiteam.com/windowsntfocus/5OP0N1PBPG.html; classtype: misc-activity; sid: 2001215; rev:7; )