[Snort-users] double decoding attack

This is a discussion on [Snort-users] double decoding attack within the Snort forums, part of the System Security and Security Related category; This is a multi-part message in MIME format. ------=_NextPart_000_0005_01C3FEFE.A3E92620 Content-Type: text/plain; charset="us-ascii" ...


Go Back   Usenet Forums > System Security and Security Related > Snort

FAQ Members List Calendar Search Today's Posts Mark Forums Read
  #1 (permalink)  
Old 03-01-2004
Mark Olbert
 
Posts: n/a
Default [Snort-users] double decoding attack

This is a multi-part message in MIME format.

------=_NextPart_000_0005_01C3FEFE.A3E92620
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit

Snort is showing a possible http double decoding attack, and it appears to
be related to AOL Instant Messenger.

Has anyone else run into this?

- Mark

mark@arcabama.com




------=_NextPart_000_0005_01C3FEFE.A3E92620
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html>

<head>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">


<meta name=3DGenerator content=3D"Microsoft Word 10 (filtered)">

<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin-top:0in;
margin-right:0in;
margin-bottom:6.0pt;
margin-left:0in;
font-size:14.0pt;
font-family:Arial;}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{font-family:Arial;
color:windowtext;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>

</head>

<body lang=3DEN-US link=3Dblue vlink=3Dpurple>

<div class=3DSection1>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:11.0pt'>Snort
is showing a possible http double decoding attack, and it appears to be =
related
to AOL Instant Messenger.</span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:11.0pt'>Has
anyone else run into this?</span></font></p>

<p class=3DMsoNormal><font size=3D4 color=3Dgreen face=3DArial><span =
style=3D'font-size:
14.0pt;color:green'>- Mark</span></font></p>

<p class=3DMsoNormal><font size=3D4 color=3Dgreen face=3DArial><span =
style=3D'font-size:
14.0pt;color:green'>mark@arcabama.com</span></font></p>

<p class=3DMsoNormal><font size=3D4 face=3DArial>&nbsp;</font></p>

</div>

</body>

</html>

------=_NextPart_000_0005_01C3FEFE.A3E92620--



-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users
Reply With Quote
Reply
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are Off
[IMG] code is Off
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT +1. The time now is 02:25 PM.


Powered by vBulletin® Version 3.7.3
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.0.0