;COMMENT: Reject big (bigger than 1K) incoming URL requests
;DESCRIPTION: Big URL requests may result in buffer overruns and web-server malfunctions, allowing Internet worms and viruses to spread. Famous viruses (e.g. Code Red) rely on big URL requests.


Big-HTTP-Request	
		Comment = "Big incoming HTTP GET request (>1K)",
		Protocol = TCP,
		Destination-Port = "80",
		Rule-Action = Deny,
		Log-Control = Enabled,
		Log-Message = "Big incoming HTTP GET request",
		Log-Details = "URL parsing of big HTTP requests are known to cause problems in several HTTP Server applications and for that reason, it is also one of the most common hacker attacks. Typically the long URL's are used to create buffer overruns in server applications (seen e.g. in Lotus Domino and Microsoft IIS). The result of such an attack can be DOS (Denial Of Service), as the server stops responding, crashes, or otherwise fail to continue. Worst case, the buffer overrun can expose security flaws in the server application, resulting in exposure of otherwise protected data. Complex Internet worms and Viruses, like the well known 'Code Red' worm, also relies on long URL requests to spread itself. Valid uses of long HTTP requests are common on Web servers, where it is part of the database design. For such systems, this rule should be disabled.",
		Offset = URL,
		Packet-Size = ">1024",
		Direction = Incoming,
		Log-Severity = Warning,
