ET HUNTING FTP (passive) LIST Response NUL Byte After Timestamp

7.0.35.0SID: 2071362Rev: 1Disabled4 views
Sourceet/open
Fileemerging-hunting.rules
CreatedAugust 3, 2026
UpdatedAugust 3, 2026
Classificationprotocol-command-decode
alert tcp $HOME_NET $FTP_PORTS -> any any (msg:"ET HUNTING FTP (passive) LIST Response NUL Byte After Timestamp"; flow:established,to_client; content:"|00|"; pcre:"/(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\x20{1,2}\d{1,2}\x20+(?:\d{2}:\d{2}|\d{4})\x00+/"; reference:url,github.com/califio/publications/tree/main/MADBugs/squidbleed; reference:cve,2026-47729; classtype:protocol-command-decode; sid:2071362; rev:1; metadata:affected_product Squid, tls_state TLSDecrypt, created_at 2026_08_03, deployment Perimeter, deployment SSLDecrypt, performance_impact Moderate, confidence High, signature_severity Minor, updated_at 2026_08_03;)

References

urlgithub.com/califio/publications/tree/main/MADBugs/squidbleed
cve2026-47729

Metadata

affected productSquid
tls stateTLSDecrypt
created at2026_08_03
deploymentSSLDecrypt
performance impactModerate
confidenceHigh
signature severityMinor
updated at2026_08_03

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!