ASN1 question

[James Lay <jlay () slave-tothe-box net>]

Hey all,

I'm trying to craft a sig that revolves around:

http://seclists.org/fulldisclosure/2012/Apr/210

but I'm not exactly sure on where to start.  I'm guessing that 
asn1:bitstring_overflow 10000 may be the ticket, but I wanted to get 
some input from here.  Any hints on if this is the right way to go?  
Thank you.

James

------------------------------------------------------------------------------
LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial
Remotely access PCs and mobile devices and provide instant support
Improve your efficiency, and focus on delivering more value-add services
Discover what IT Professionals Know. Rescue delivers
http://p.sf.net/sfu/logmein_12329d2d
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!