equivalent cisco "SMTP HELO overflow attempt" signature

[darin.marais]

I have two questions

1. Does Cisco have an equivalent for the following snort signature?

SID 1549

Message SMTP HELO overflow attempt

Signature alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP HELO overflow attempt"; flow:to_server,established; content:"HELO"; isdataat:500,relative; pcre:"/^HELO\s[^\n]{500}/smi"; reference:bugtraq,895; reference:cve,CVE-2000-0042; reference:nessus,10324; reference:bugtraq,7726; reference:nessus,11674; classtype:attempted-admin; sid:1549; rev:13;)

This event is generated when an attempt is made to overflow a buffer in an SMTP server via a long SMTP HELO command.

2. Are there any signatures to detect the WALLON worm.

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_WALLON.A

I am aware of the mhtml vulnerability signature but I am looking for some more specific signatures to detect the exploit

Can anybody help??

[mcerha]

We do not have a signature for the first question. The Bugtraq references are either really old (1999) and / or obscure mail servers that are probably not widely used. This is why signatures were not written originally. You can easily create a custom with the STRING.TCP engine on port 25. The RegexString would be

[Hh][Ee][Ll][Oo][ \t].*[\r\n]

with a MinMatchLength of 500.

I will add the WALLON.A worm for consideration for the S93 signature update.