X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?a=blobdiff_plain;f=etc%2Frules%2Fapache_rules.xml;h=425c0b9eeaf31b02a6cdb2860013af73bcde13e5;hb=7ff47fde062004336c7d4487daa70dc6e6ef81c8;hp=1a723dc39b3467adcb39a2521f8fcb8bdaf24767;hpb=914feba5d54f979cd5d7e69c349c3d01f630042a;p=ossec-hids.git

diff --git a/etc/rules/apache_rules.xml b/etc/rules/apache_rules.xml
index 1a723dc..425c0b9 100755
--- a/etc/rules/apache_rules.xml
+++ b/etc/rules/apache_rules.xml
@@ -1,4 +1,5 @@
-<!-- @(#) $Id: apache_rules.xml,v 1.36 2009/09/16 14:19:45 dcid Exp $
+<!-- @(#) $Id: ./etc/rules/apache_rules.xml, 2011/09/08 dcid Exp $
+
   -  Official Apache rules for OSSEC.
   -
   -  Copyright (C) 2009 Trend Micro Inc.
@@ -6,7 +7,7 @@
   -
   -  This program is a free software; you can redistribute it
   -  and/or modify it under the terms of the GNU General Public
-  -  License (version 3) as published by the FSF - Free Software
+  -  License (version 2) as published by the FSF - Free Software
   -  Foundation.
   -
   -  License details: http://www.ossec.net/en/licensing.html
@@ -43,7 +44,7 @@
     <if_sid>30103</if_sid>
     <match>exit signal Segmentation Fault</match>
     <description>Apache segmentation fault.</description>
-    <info>http://www.securityfocus.com/infocus/1633</info>
+    <info type="link">http://www.securityfocus.com/infocus/1633</info>
     <group>service_availability,</group>
   </rule>
 
@@ -65,7 +66,8 @@
     <if_sid>30101</if_sid>
     <match>Client sent malformed Host header</match>
     <description>Code Red attack.</description>
-    <info>http://www.cert.org/advisories/CA-2001-19.html</info>
+    <info type="link">http://www.cert.org/advisories/CA-2001-19.html</info>
+    <info type="text">CERT: Advisory CA-2001-19 "Code Red" Worm Exploiting Buffer Overflow In IIS Indexing Service DLL</info>
     <group>automatic_attack,</group>
   </rule>
 
@@ -78,7 +80,7 @@
 
   <rule id="30109" level="9">
     <if_sid>30101</if_sid>
-    <regex>user \S+ not found</regex>
+    <regex>user \S+ not found|user \S+ in realm \.* not found</regex>
     <description>Attempt to login using a non-existent user.</description>
     <group>invalid_login,</group>
   </rule>