About custom vulnerability signature

KiCheon.Lee — Tue, 17 Jun 2014 07:19:43 GMT

Hello,

My customer made vulnerability signature in FW. But FW doesn't detect this signature.

Customer Vulnerability Signature

context : http-req-message-body

pattern : eval\(gzinflate\(str_rot13\(base64_decode

I am searching this but I don't know.

So I need your assistance for it.

I have read Creating_Custom_Signatures-RevA.pdf document

This document describe as the following message.

http-req-message-body

Description: Body content of a HTTP request when the body content cannot be recognized as URL encoded or MIME type data using the Content-type field.

Do you know to relate between not detecting signature and this description??

Thanks

Re: About custom vulnerability signature

kadak — Tue, 17 Jun 2014 14:24:21 GMT

Hello cheon,

Your question would be best answered in the following community : DevCenter

Thanks and regards,

Kunal Adak

KiCheon.Lee — Tue, 17 Jun 2014 16:02:49 GMT

OK, Kunal Adak.

Thanks.