alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "BLEEDING-EDGE WEB-CLIENT Apple Quicktime RTSP Content-Type overflow attempt"; flow:established,from_server; content:"RTSP/"; nocase; depth:5; content:"|0a|Content-Type|3a|"; nocase; distance:0; content:!"|0a|"; within:50; reference:url,www.kb.cert.org/vuls/id/659761; reference: url,www.milw0rm.com/exploits/4657; classtype:attempted-user; sid:2007703; rev:3; )

Added 2007-12-04 00:16:47 UTC

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "BLEEDING-EDGE WEB-CLIENT Apple Quicktime RTSP Content-Type overflow attempt"; flow:established,from_server; content:"RTSP/"; nocase; depth:5; content:"|0a|Content-Type|3a|"; nocase; distance:0; content:!"|0a|"; within:50; reference:url,www.kb.cert.org/vuls/id/659761; reference: url,www.milw0rm.com/exploits/4657; classtype:attempted-user; sid:2007703; rev:3; )

Added 2007-12-04 00:16:47 UTC

alert tcp $EXTERNAL_NET 554 -> $HOME_NET any (msg: "BLEEDING-EDGE WEB-CLIENT Apple Quicktime RTSP Content-Type overflow attempt"; flow:established,from_server; content:"RTSP/"; nocase; depth:5; content:"|0a|Content-Type|3a|"; nocase; distance:0; content:!"|0a|"; within:50; reference:url,www.kb.cert.org/vuls/id/659761; reference: url,www.milw0rm.com/exploits/4657; classtype:attempted-user; sid:2007703; rev:2; )

Added 2007-11-29 14:31:05 UTC

alert tcp $EXTERNAL_NET 554 -> $HOME_NET any (msg: "BLEEDING-EDGE WEB-CLIENT Apple Quicktime RTSP Content-Type overflow attempt"; flow:established,from_server; content:"RTSP/"; nocase; depth:5; content:"|0a|Content-Type|3a|"; nocase; distance:0; content:!"|0a|"; within:50; reference:url,www.kb.cert.org/vuls/id/659761; reference: url,www.milw0rm.com/exploits/4657; classtype:attempted-user; sid:2007703; rev:2; )

Added 2007-11-29 14:31:05 UTC

alert tcp $EXTERNAL_NET 554 -> $HOME_NET any (msg: "BLEEDING-EDGE WEB-CLIENT Apple Quicktime RTSP Content-Type overflow attempt"; flow:established,from_server; content:"RTSP/"; nocase; depth:5; content:"|0a|Content-Type:"; nocase; distance:0; content:!"|0a|"; within:50; reference:url,www.kb.cert.org/vuls/id/659761; reference: url,www.milw0rm.com/exploits/4657; classtype:attempted-user; sid:2007703; rev:1; )

Added 2007-11-28 23:31:06 UTC