Re: SID 1287

[Brian <bmc () snort org>]

> Yaeh, right. I did found the SID causing the alerts that's not my
> problem.
> My question is : WHY should snort alert on this?

Well, things in the "/scripts/" directory tend to be very bad.  This
is one of the many directories that IIS puts sample scripts in by 
default.  If you look at web-iis.rules, there are a TON of rules that 
include vulnerable applications in /scripts/. 

If you have audited your web servers and made sure only audited programs
exist in the /scripts/ directory, then you should feel confidant that you
can disable that rule.

-brian


-------------------------------------------------------
This sf.net email is sponsored by: See the NEW Palm 
Tungsten T handheld. Power & Color in a compact size!
http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0001en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users