Snort mailing list archives
Re: Office application cause false Nachi signature
From: Brian <bmc () snort org>
Date: Thu, 11 Dec 2003 16:54:43 -0500
On Thu, Dec 11, 2003 at 01:02:32PM -0500, Elijah Savage wrote:
I know that the snort virus signatures are not being maintained but I was told this morning that one of the applications in Microsoft Office which they thought it was outlook, that if you have it setup a certain way something to do with calendaring that it would actually generate the same icmp traffic that NACHI does which would cause false alarms in snort if you were using this. I have looked all over Google and this mailing list but I can't find anything he mentioned that it came from this mailing list. Can anyone verify and let me know which application?
I've never heard of setting up microsoft applications on a host would make the host act like it was infected by a worm. That is, other than actually infecting the host with a worm. Brian ------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Office application cause false Nachi signature Elijah Savage (Dec 11)
- Re: Office application cause false Nachi signature Brian (Dec 12)