RE: [Snort-sigs] Sid:1845 IMAP list overflow attempt

From: Schmehl, Paul L <pauls(at)utdallas.edu>
Date: Wed Feb 26 2003 - 21:55:42 EST

Argh! I saw the not, just misinterpreted what it meant. Thanks for clarifying it.

Paul Schmehl (pauls@utdallas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/

-----Original Message-----
From: Kenneth G. Arnold [mailto:bkarnold@cbu.edu] Sent: Wednesday, February 26, 2003 8:25 PM To: Schmehl, Paul L
Cc: snort-sigs@lists.sourceforge.net
Subject: RE: [Snort-sigs] Sid:1845 IMAP list overflow attempt

There is a ! character in front of the |0a| which means that there is no |0a| character within the first 1024 bytes. This would be the case if someone were trying to overflow something. There would be a very large distance to the |0a| character.

---

This SF.net email is sponsored by: Scholarships for Techies! Can't afford IT training? All 2003 ictp students receive scholarships. Get hands-on training in Microsoft, Cisco, Sun, Linux/UNIX, and more. www.ictp.com/training/sourceforge.asp

---

Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs Received on Wed Feb 26 22:22:52 2003