alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET CURRENT_EVENTS JavaScript? Determining OS MAC and Serving Java Archive File"; flow:established,to_client; file_data; content:"<script"; distance:0; content:"navigator.userAgent.indexOf|28 27|Mac|27 29|"; distance:0; nocase; content:"setAttribute|28 27|code|27|"; distance:0; nocase; content:".class"; nocase; distance:0; content:"setAttribute|28 27|archive|27|"; distance:0; nocase; content:".jar"; nocase; distance:0; reference:url,; reference:cve,2011-3544; classtype:bad-unknown; sid:2014565; rev:2;)

Added 2012-04-16 18:46:11 UTC

Topic revision: r1 - 2012-04-16 - TWikiGuest
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats