02233

Netværkssikkerhed
Network Security

• Introduktion
• Nessus Scan
• Nessus Questions
• Snort Questions
  • Question 1
  • Question 2
  • Question 3
  • Question 4
  • Question 5
  • Question 6
  • Question 7
  • Question 8
  • Question 9
  • Question 10
  • Question 11
  • Question 12
  • Question 13
  • Question 14
  • Question 15
  • Question 16
  • Question 17
  • Question 18
• References

Question 4

Will it be possible to use Snort to detect zero day exploits?

Yes, Snort has been used recently to detect a new vulnerability in Ethereal related to an NT ACE parsing DoS exploit.
It has also been used to detect a 0 day vulnerability in Samba, a file and print serving system in Networks, where the possibility of an integer overflow in an SMB daemon was found be lead to a possible exploit.
Snort is able to do this because of the ease of writing new rules and integrating them into its detection engine.

references to these !!!

Bjarne D Mathiesen

Michael Pantridge

Thabet Al-Assdi

Chang Jensen