Re: [mod-security-users] Santy worm

[Gerwin K. -|- D. W. <ge...@di...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Ye we already had some site being defaced. But i made a good filter i think:

SecFilterSelective ARGS "fwrite"
SecFilterSelective ARGS "fopen"
SecFilterSelective ARGS "chr\("
SecFilterSelective ARGS "echr\("
SecFilterSelective ARGS "system\("

Support wrote:
| Has anyone found a way to block the Santy worm with mod_security?
|
| http://www.f-secure.com/v-descs/santy_a.shtml
|
|
|
|
| -------------------------------------------------------
| SF email is sponsored by - The IT Product Guide
| Read honest & candid reviews on hundreds of IT Products from real users.
| Discover which products truly live up to the hype. Start reading now.
| http://productguide.itmanagersjournal.com/
| _______________________________________________
| mod-security-users mailing list
| mod...@li...
| https://lists.sourceforge.net/lists/listinfo/mod-security-users
|
|


- --
Met vriendelijke groet/With kind regards,

Gerwin Krist

Digitalus
First-class Internet Webhosting

(w) http://www.digitalus.nl
(e) gerwin at digitalus.nl
(p) PGP-ID: 79B325D4
(t) +31 (0) 598 630000
(f) +31 (0) 598 631860


***************************************************************************************
This message may contain information which is confidential or privileged.
If you are not the intended recipient, please advise the sender immediately
by reply e-mail and delete this message and any attachments without
retaining
a copy.
***************************************************************************************


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFByRqsCwaJ0XmzJdQRAmrnAJ9rjD83f1EScGOMwHWqgWf66jrA6QCgrSW7
VwfHM7nnT9VLJLQCO5XGQNs=
=Y1xy
-----END PGP SIGNATURE-----