0.0.0.0 as a target means the signature entered regular or global summary mode. When this happens, you'll get the initial alert with full source & target info, and then a follow on summary event (usually for a 30 second window by default) with a count of how often the source address triggered an event. Since the target could be different in the summary, it display it as 0.0.0.0.
This behavior is tunable by editing the signature and choosing the summary-key of attacker & victim (to prevent 0.0.0.0 as a target). You can also change the summary-interval and choose a number larger than 30 (in seconds - to get longer summary intervals).
Hope this helps.