Re: Another uricontent question

[Chris Green <cmg () sourcefire com>]

"Lawrence Reed" <Lawrence.Reed () noaa gov> writes:

> Do uricontent's get checked in sequentially like content options?  

only with the advent of distance/within did they get checked
sequentially in packet order.

> In particular sid 1072 has two uricontent options.  According to
> most of the advisories these two uricontents need to appear in the
> order they are defined ie "GET /.nsf/../somefile".  However I am
> receiving alerts for URI like "GET /../prog.nsf/data/file".  Is this
> expected behaviour?

Yes.  I don't think that distance and within work with uricontents.
In fact, I'm very sure they don't.

-- 
Chris Green <cmg () sourcefire com>
Let not the sands of time get in your lunch.


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users