Re: SID 18773

[JJ Cummings <cummingsj () gmail com>]

Did you check out any of the references?

Sent from the iRoad

On Jan 12, 2012, at 7:34, vincent () ragosta net wrote:

> What ex​actly is Snort SID 18773 attempting to alert on?  The rule name is 'BLACKLIST URI for known malicious URI - 
> /stat.htm" and contains some very specific content clauses.  When I follow the URL specified by one of these alerts, 
> it points to a 1x1 pixel GIF image.  Is this part of a known exploit?
>
> Thanks,
>
> Vincent
> ------------------------------------------------------------------------------
> RSA(R) Conference 2012
> Mar 27 - Feb 2
> Save $400 by Jan. 27
> Register now!
> http://p.sf.net/sfu/rsa-sfdev2dev2
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs () lists sourceforge net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs
> http://www.snort.org
>
>
> Please visit http://blog.snort.org for the latest news about Snort!

------------------------------------------------------------------------------
RSA(R) Conference 2012
Mar 27 - Feb 2
Save $400 by Jan. 27
Register now!
http://p.sf.net/sfu/rsa-sfdev2dev2
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!