MS09-063

alert tcp any any -> any 5357:5358 (flow:established, to_server; content:”|0d0a|MIME-Version|3a20|”; nocase; pcre:”/^MIME\x2dVersion\x3a\s+[^\r\n]{2000,}/im”;)

Advertisements

About this entry