alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER HP OpenView? /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"; flow:established,to_server; content:"POST "; depth:5; nocase; uricontent:"/OvCgi/Toolbar.exe"; nocase; content:"Accept-Language|3A|"; nocase; isdataat:1350,relative; content:!"|0A|"; within:1350; content:"Content-Length|3A|"; nocase; distance:1350; pcre:"/Accept-Language\x3A.{1350}.+Content-Length\x3A/smi"; reference:cve,2009-0921; reference:url,doc.emergingthreats.net/2010864; classtype:web-application-attack; sid:2010864; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)

Added 2017-08-07 21:04:00 UTC


alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER HP OpenView? /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/OvCgi/Toolbar.exe"; nocase; http_uri; content:"Accept-Language|3A|"; nocase; isdataat:1350,relative; content:!"|0A|"; within:1350; reference:cve,2009-0921; reference:url,doc.emergingthreats.net/2010864; classtype:web-application-attack; sid:2010864; rev:9;)

Added 2011-10-12 19:30:46 UTC


alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER HP OpenView? /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/OvCgi/Toolbar.exe"; nocase; http_uri; content:"Accept-Language|3A|"; nocase; isdataat:1350,relative; content:!"|0A|"; within:1350; classtype:web-application-attack; reference:cve,2009-0921; reference:url,doc.emergingthreats.net/2010864; sid:2010864; rev:9;)

Added 2011-09-14 22:43:55 UTC


alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER HP OpenView? /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/OvCgi/Toolbar.exe"; nocase; http_uri; content:"Accept-Language|3A|"; nocase; isdataat:1350,relative; content:!"|0A|"; within:1350; classtype:web-application-attack; reference:cve,2009-0921; reference:url,doc.emergingthreats.net/2010864; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SERVER/WEB_HP_Openview; sid:2010864; rev:9;)

Added 2011-02-04 17:30:32 UTC


alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SERVER HP OpenView? /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"; flow:established,to_server; content:"POST "; depth:5; nocase; uricontent:"/OvCgi/Toolbar.exe"; nocase; content:"Accept-Language|3A|"; nocase; content:!"|0A|"; within:1350; isdataat:1350; content:"Content-Length|3A|"; nocase; distance:1350; pcre:"/Accept-Language\x3A.{1350}.+Content-Length\x3A/smi"; classtype:web-application-attack; reference:cve,2009-0921; reference:url,doc.emergingthreats.net/2010864; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SERVER/WEB_HP_Openview; sid:2010864; rev:4;)

Added 2010-08-20 14:16:25 UTC


alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SERVER HP OpenView? /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"; flow:established,to_server; content:"POST "; depth:5; nocase; uricontent:"/OvCgi/Toolbar.exe"; nocase; content:"Accept-Language|3A|"; nocase; content:!"|0A|"; within:1350; isdataat:1350; content:"Content-Length|3A|"; nocase; distance:1350; pcre:"/Accept-Language\x3A.{1350}.+Content-Length\x3A/smi"; classtype:web-application-attack; reference:cve,2009-0921; reference:url,doc.emergingthreats.net/2010864; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SERVER/WEB_HP_Openview; sid:2010864; rev:4;)

Added 2010-08-20 14:16:25 UTC


alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER HP OpenView? /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"; flow:established,to_server; content:"POST "; depth:5; nocase; uricontent:"/OvCgi/Toolbar.exe"; nocase; content:"Accept-Language|3A|"; nocase; content:!"|0A|"; within:1350; isdataat:1350; content:"Content-Length|3A|"; nocase; distance:1350; pcre:"/Accept-Language\x3A.{1350}.+Content-Length\x3A/smi"; classtype:web-application-attack; reference:cve,2009-0921; reference:url,doc.emergingthreats.net/2010864; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SERVER/WEB_HP_Openview; sid:2010864; rev:3;)

Added 2010-04-14 11:00:57 UTC


alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER HP OpenView? /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"; flow:established,to_server; content:"POST "; depth:5; nocase; uricontent:"/OvCgi/Toolbar.exe"; nocase; content:"Accept-Language|3A|"; nocase; content:!"|0A|"; within:1350; isdataat:1350; content:"Content-Length|3A|"; nocase; distance:1350; pcre:"/Accept-Language\x3A.{1350}.+Content-Length\x3A/smi"; classtype:web-application-attack; reference:cve,2009-0921; reference:url,doc.emergingthreats.net/2010864; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SERVER/WEB_HP_Openview; sid:2010864; rev:3;)

Added 2010-04-14 11:00:57 UTC


alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER HP OpenView? /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"; content:"POST "; depth:5; nocase; uricontent:"/OvCgi/Toolbar.exe"; nocase; content:"Accept-Language|3A|"; nocase; content:!"|0A|"; within:1350; isdataat:1350; content:"Content-Length|3A|"; nocase; distance:1350; pcre:"/Accept-Language\x3A.{1350}.+Content-Length\x3A/smi"; classtype:web-application-attack; reference:cve,2009-0921; reference:url,doc.emergingthreats.net/2010864; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SERVER/WEB_HP_Openview; sid:2010864; rev:2;)

Added 2010-02-28 12:45:48 UTC


alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER HP OpenView? /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"; content:"POST "; depth:5; nocase; uricontent:"/OvCgi/Toolbar.exe"; nocase; content:"Accept-Language|3A|"; nocase; content:!"|0A|"; within:1350; isdataat:1350; content:"Content-Length|3A|"; nocase; distance:1350; pcre:"/Accept-Language\x3A.{1350}.+Content-Length\x3A/smi"; classtype:web-application-attack; reference:cve,2009-0921; reference:url,doc.emergingthreats.net/2010864; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_SERVER/WEB_HP_Openview; sid:2010864; rev:2;)

Added 2010-02-28 12:44:06 UTC


Topic revision: r1 - 2017-08-08 - TWikiGuest
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats