Snort mailing list archives
Defect on rule 13514
From: Jack Pepper <pepperjack () afferentsecurity com>
Date: Fri, 11 Jul 2008 07:23:21 -0500
The PCRE in 13514 looks like this:
pcre:"/update[^\n]*set/i";
and so picks up all kinds of stuff. I suspect you meant to catch the syntax:
update[space][tablename][space]set
Right? Might I suggest a PCRE that looks like this:
pcre:"/update\h\w\hset/i"
jp -- Framework? I don't need no stinking framework! ---------------------------------------------------------------- @fferent Security Labs: Isolate/Insulate/Innovate http://www.afferentsecurity.com ------------------------------------------------------------------------- Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW! Studies have shown that voting for your favorite open source project, along with a healthy diet, reduces your potential for chronic lameness and boredom. Vote Now at http://www.sourceforge.net/community/cca08 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Defect on rule 13514 Jack Pepper (Jul 11)
- Re: Defect on rule 13514 Markus Lude (Jul 11)
- Re: Defect on rule 13514 Joel Esler (Jul 11)
- Re: Defect on rule 13514 Markus Lude (Jul 11)