Yara Rule for CVE-2010-1885

Posted: June 11th, 2010 | Author: | Filed under: IT Related | Tags: , , , | 3 Comments » 
rule HelpSupportCenter
{
   meta:  
      ref = "CVE-2010-1885"
      hide = true
      impact = 5 
   strings:
      $cve20101885 = /hcp:\/\/.*?(%u?[A-F]{1,4}.*?){90}/
   condition:
       all of them
}

3 Comments on “Yara Rule for CVE-2010-1885”

  1. 1 adik nan said at 7:43 PM on June 13th, 2010:

    abg nan, kalau attacker guna “%B%%B%%B” xdetect lah kan? kui3

  2. 2 xanda said at 2:48 PM on June 15th, 2010:

    @adik nan
    nanti aku tambah

  3. 3 xanda said at 12:21 PM on June 25th, 2010:

    @adik nan
    ok updated… thanks

Leave a Reply