new upstream release (3.3.0); modify package compatibility for Stretch

[ossec-hids.git] / etc / rules / attack_rules.xml

diff --git a/etc/rules/attack_rules.xml b/etc/rules/attack_rules.xml
old mode 100755 (executable)
new mode 100644 (file)
index bcc5195..5cdfeda
--- a/etc/rules/attack_rules.xml
+++ b/etc/rules/attack_rules.xml
@@ -1,4 +1,5 @@
-<!-- @(#) $Id: attack_rules.xml,v 1.18 2009/06/24 17:06:19 dcid Exp $
+<!-- @(#) $Id: ./etc/rules/attack_rules.xml, 2011/09/08 dcid Exp $
+
   -  Official "attack" correlation rules for OSSEC.
   -
   -  Copyright (C) 2009 Trend Micro Inc.
@@ -6,7 +7,7 @@
   -
   -  This program is a free software; you can redistribute it
   -  and/or modify it under the terms of the GNU General Public
-  -  License (version 3) as published by the FSF - Free Software
+  -  License (version 2) as published by the FSF - Free Software
   -  Foundation.
   -
   -  License details: http://www.ossec.net/en/licensing.html
@@ -59,7 +60,7 @@
   <rule id="40107" level="14">
     <regex>cachefsd: Segmentation Fault - core dumped</regex>
     <description>Heap overflow in the Solaris cachefsd service.</description>
-    <cve>2002-0033</cve>
+    <info type='cve'>2002-0033</info>
     <group>exploit_attempt,</group>
   </rule>
 
@@ -67,7 +68,7 @@
     <match>attempt to execute code on stack by</match>
     <description>Stack overflow attempt or program exiting </description>
     <description>with SEGV (Solaris).</description>
-    <info>http://snap.nlc.dcccd.edu/reference/sysadmin/julian/ch18/389-392.html</info>
+    <info type="link">http://snap.nlc.dcccd.edu/reference/sysadmin/julian/ch18/389-392.html</info>
     <group>exploit_attempt,</group>
   </rule>
 
@@ -95,7 +96,7 @@
 
 
 
-<!-- Privilege scalation messages -->
+<!-- Privilege escalation messages -->
 <group name="syslog,elevation_of_privilege,">
   <rule id="40501" level="15" timeframe="300" frequency="2">
     <if_group>adduser</if_group>
@@ -113,7 +114,7 @@
     <if_matched_group>connection_attempt</if_matched_group>
     <description>Network scan from same source ip.</description>
     <same_source_ip />
-    <info>http://project.honeynet.org/papers/enemy2/</info>
+    <info type="link">http://project.honeynet.org/papers/enemy2/</info>
   </rule>
 </group> <!-- SYSLOG,SCANS -->