Webcast Teaser -- Basic Buffer Overflow Detection
Summary: Cisco Talos announced a webcast on Snort rule writing for 1pm EST on Wednesday, September 17, 2008, using published VRT rules to demonstrate rule structures, options, and common pitfalls. The teaser walks through SID 13916, an Alt-N SecurityGateway username buffer overflow detection that anchors on a case-insensitive "username=" match, then uses isdataat:450,relative and two negative content matches to confirm 450 bytes of payload without an "&" or \x0a terminator.
Key Takeaway: The post notes that a negative content match returns successful even when it runs out of data before reaching the within:450 requirement, which can false-positive on a TCP message split across two packets - the isdataat check exists specifically to prevent that, and getting it wrong means either noisy alerts or wasted inspection overhead on every matching packet.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026