alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER HP OpenView? /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/OvCgi/Toolbar.exe"; nocase; fast_pattern; http_uri; content:"Accept-Language|3a 20|"; nocase; isdataat:1350,relative; http_header; content:!"|0A|"; within:1350; http_header; content:"Content-Length|3a|"; distance:0; http_header; reference:cve,2009-0921; reference:url,doc.emergingthreats.net/2010864; classtype:web-application-attack; sid:2010864; rev:9; metadata:created_at 2010_07_30, updated_at 2020_11_02;)

Added 2020-11-02 18:29:13 UTC

Please enter documentation, comments, false positives, or concerns with this signature. Press the Attach button below to add samples or Pcaps.

---

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER HP OpenView? /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"; flow:established,to_server; content:"POST "; depth:5; nocase; content:"/OvCgi/Toolbar.exe"; http_uri; nocase; content:"Accept-Language|3A|"; nocase; isdataat:1350,relative; content:!"|0A|"; within:1350; content:"Content-Length|3A|"; nocase; distance:1350; pcre:"/Accept-Language\x3A.{1350}.+Content-Length\x3A/smi"; reference:cve,2009-0921; reference:url,doc.emergingthreats.net/2010864; classtype:web-application-attack; sid:2010864; rev:8; metadata:created_at 2010_07_30, updated_at 2019_09_27;)

Added 2019-09-27 18:53:36 UTC

---

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER HP OpenView? /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"; flow:established,to_server; content:"POST "; depth:5; nocase; content:"/OvCgi/Toolbar.exe"; http_uri; nocase; content:"Accept-Language|3A|"; nocase; isdataat:1350,relative; content:!"|0A|"; within:1350; content:"Content-Length|3A|"; nocase; distance:1350; pcre:"/Accept-Language\x3A.{1350}.+Content-Length\x3A/smi"; reference:cve,2009-0921; reference:url,doc.emergingthreats.net/2010864; classtype:web-application-attack; sid:2010864; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)

Added 2019-08-22 20:13:01 UTC

---

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER HP OpenView? /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"; flow:established,to_server; content:"POST "; depth:5; nocase; uricontent:"/OvCgi/Toolbar.exe"; nocase; content:"Accept-Language|3A|"; nocase; isdataat:1350,relative; content:!"|0A|"; within:1350; content:"Content-Length|3A|"; nocase; distance:1350; pcre:"/Accept-Language\x3A.{1350}.+Content-Length\x3A/smi"; reference:cve,2009-0921; reference:url,doc.emergingthreats.net/2010864; classtype:web-application-attack; sid:2010864; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)

Added 2018-09-13 19:41:41 UTC

---

Added 2018-09-13 17:54:47 UTC

---

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER HP OpenView? /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"; flow:established,to_server; content:"POST "; depth:5; nocase; uricontent:"/OvCgi/Toolbar.exe"; nocase; content:"Accept-Language|3A|"; nocase; isdataat:1350,relative; content:!"|0A|"; within:1350; content:"Content-Length|3A|"; nocase; distance:1350; pcre:"/Accept-Language\x3A.{1350}.+Content-Length\x3A/smi"; reference:cve,2009-0921; reference:url,doc.emergingthreats.net/2010864; classtype:web-application-attack; sid:2010864; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)

Added 2017-08-07 21:04:00 UTC

---

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER HP OpenView? /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/OvCgi/Toolbar.exe"; nocase; http_uri; content:"Accept-Language|3A|"; nocase; isdataat:1350,relative; content:!"|0A|"; within:1350; reference:cve,2009-0921; reference:url,doc.emergingthreats.net/2010864; classtype:web-application-attack; sid:2010864; rev:9;)

Added 2011-10-12 19:30:46 UTC

---

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER HP OpenView? /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/OvCgi/Toolbar.exe"; nocase; http_uri; content:"Accept-Language|3A|"; nocase; isdataat:1350,relative; content:!"|0A|"; within:1350; classtype:web-application-attack; reference:cve,2009-0921; reference:url,doc.emergingthreats.net/2010864; sid:2010864; rev:9;)

Added 2011-09-14 22:43:55 UTC

---

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER HP OpenView? /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/OvCgi/Toolbar.exe"; nocase; http_uri; content:"Accept-Language|3A|"; nocase; isdataat:1350,relative; content:!"|0A|"; within:1350; classtype:web-application-attack; reference:cve,2009-0921; reference:url,doc.emergingthreats.net/2010864; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SERVER/WEB_HP_Openview; sid:2010864; rev:9;)

Added 2011-02-04 17:30:32 UTC

---

alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SERVER HP OpenView? /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"; flow:established,to_server; content:"POST "; depth:5; nocase; uricontent:"/OvCgi/Toolbar.exe"; nocase; content:"Accept-Language|3A|"; nocase; content:!"|0A|"; within:1350; isdataat:1350; content:"Content-Length|3A|"; nocase; distance:1350; pcre:"/Accept-Language\x3A.{1350}.+Content-Length\x3A/smi"; classtype:web-application-attack; reference:cve,2009-0921; reference:url,doc.emergingthreats.net/2010864; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SERVER/WEB_HP_Openview; sid:2010864; rev:4;)

Added 2010-08-20 14:16:25 UTC

---

alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SERVER HP OpenView? /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"; flow:established,to_server; content:"POST "; depth:5; nocase; uricontent:"/OvCgi/Toolbar.exe"; nocase; content:"Accept-Language|3A|"; nocase; content:!"|0A|"; within:1350; isdataat:1350; content:"Content-Length|3A|"; nocase; distance:1350; pcre:"/Accept-Language\x3A.{1350}.+Content-Length\x3A/smi"; classtype:web-application-attack; reference:cve,2009-0921; reference:url,doc.emergingthreats.net/2010864; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SERVER/WEB_HP_Openview; sid:2010864; rev:4;)

Added 2010-08-20 14:16:25 UTC

---

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER HP OpenView? /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"; flow:established,to_server; content:"POST "; depth:5; nocase; uricontent:"/OvCgi/Toolbar.exe"; nocase; content:"Accept-Language|3A|"; nocase; content:!"|0A|"; within:1350; isdataat:1350; content:"Content-Length|3A|"; nocase; distance:1350; pcre:"/Accept-Language\x3A.{1350}.+Content-Length\x3A/smi"; classtype:web-application-attack; reference:cve,2009-0921; reference:url,doc.emergingthreats.net/2010864; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SERVER/WEB_HP_Openview; sid:2010864; rev:3;)

Added 2010-04-14 11:00:57 UTC

---

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER HP OpenView? /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"; flow:established,to_server; content:"POST "; depth:5; nocase; uricontent:"/OvCgi/Toolbar.exe"; nocase; content:"Accept-Language|3A|"; nocase; content:!"|0A|"; within:1350; isdataat:1350; content:"Content-Length|3A|"; nocase; distance:1350; pcre:"/Accept-Language\x3A.{1350}.+Content-Length\x3A/smi"; classtype:web-application-attack; reference:cve,2009-0921; reference:url,doc.emergingthreats.net/2010864; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SERVER/WEB_HP_Openview; sid:2010864; rev:3;)

Added 2010-04-14 11:00:57 UTC

---

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER HP OpenView? /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"; content:"POST "; depth:5; nocase; uricontent:"/OvCgi/Toolbar.exe"; nocase; content:"Accept-Language|3A|"; nocase; content:!"|0A|"; within:1350; isdataat:1350; content:"Content-Length|3A|"; nocase; distance:1350; pcre:"/Accept-Language\x3A.{1350}.+Content-Length\x3A/smi"; classtype:web-application-attack; reference:cve,2009-0921; reference:url,doc.emergingthreats.net/2010864; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SERVER/WEB_HP_Openview; sid:2010864; rev:2;)

Added 2010-02-28 12:45:48 UTC

---

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER HP OpenView? /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"; content:"POST "; depth:5; nocase; uricontent:"/OvCgi/Toolbar.exe"; nocase; content:"Accept-Language|3A|"; nocase; content:!"|0A|"; within:1350; isdataat:1350; content:"Content-Length|3A|"; nocase; distance:1350; pcre:"/Accept-Language\x3A.{1350}.+Content-Length\x3A/smi"; classtype:web-application-attack; reference:cve,2009-0921; reference:url,doc.emergingthreats.net/2010864; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SERVER/WEB_HP_Openview; sid:2010864; rev:2;)

Added 2010-02-28 12:44:06 UTC

---