ET EXPLOIT Potential RoaringBeast ProFTPd Exploit nsswitch.conf Upload

SID: 2015514Rev: 20 viewsHistory

Sourceet/open

CreatedJuly 24, 2012

UpdatedJuly 26, 2019

Classificationtrojan-activity

alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET EXPLOIT Potential RoaringBeast ProFTPd Exploit nsswitch.conf Upload"; flow:established,to_server; content:"STOR "; content:"nsswitch.conf|0d 0a|"; distance:0; pcre:"/^\s*?STOR\s+[^\r\n]*?nsswitch\.conf\r$/mi"; reference:url,www.exploit-db.com/exploits/18181/; reference:url,stopmalvertising.com/malware-reports/the-c3284d-malware-network-stats.php.html; classtype:trojan-activity; sid:2015514; rev:2; metadata:created_at 2012_07_24, signature_severity Major, updated_at 2019_07_26;)

References

url	www.exploit-db.com/exploits/18181/
url	stopmalvertising.com/malware-reports/the-c3284d-malware-network-stats.php.html

ET EXPLOIT Potential RoaringBeast ProFTPd Exploit nsswitch.conf Upload

References

Metadata

Comments (0)