Date: Mon, 01 Jul 2002 13:57:52 -0700 From: Steve McGhee <stevem@lmri.ucsb.edu> To: snort-users@lists.sourceforge.net Cc: freebsd-security@freebsd.org, freebsd-ports@freebsd.org Subject: instant snort sigs for new vulnerabilites Message-ID: <3D20C250.1020603@lmri.ucsb.edu>
next in thread | raw e-mail | index | archive | help
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 with all the fuss lately over the new apache worm, etc, id like to know if my machine is getting hit (its patched, just being curious). i know about mod_blowchunks, but im looking for something more general.. it seems to me that snort could see these attacks pretty easily. is there a tool/method out there that will retrieve the *latest* snort signatures automatically? for those of us not running snort via CVS, id like a way to do something like cvsup, but _only_ update my ruleset every night or whatever. i cc: the freebsd team as this might be a cool (simple) port. (something like /usr/ports/security/snort-signatures) this could be helpful to people who are just curious, or maybe could provide some good numbers to shock lazy sysadmins into actually patching their machines. ..of course, this is all assuming there's someone out there writing signatures ;) - -- - -steve ~ .......................................................... ~ Steve McGhee ~ Systems Administrator ~ Linguistic Minority Research Institute ~ UC Santa Barbara ~ phone: (805)893-2683 ~ email: stevem@lmri.ucsb.edu -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.8 Comment: Using PGP with Mozilla - http://enigmail.mozdev.org iQA/AwUBPSDCUKUr5syonrLMEQKjYQCfRiRGHIGGviqfGl/9xvRNpaambakAoIns BcxrxnUpvAJK3Sczy5nY4Ir5 =9LCO -----END PGP SIGNATURE----- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ports" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3D20C250.1020603>