Re: Defect on rule 13514

[Markus Lude <markus.lude () gmx de>]

On Fri, Jul 11, 2008 at 07:23:21AM -0500, Jack Pepper wrote:
> The PCRE in 13514 looks like this:
>
> > pcre:"/update[^\n]*set/i";
>
> and so picks up all kinds of stuff.  I suspect you meant to catch the syntax:
>
> >  update[space][tablename][space]set
>
> Right?
>
> Might I suggest a PCRE that looks like this:
>
> > pcre:"/update\h\w\hset/i"

This is probably not what you intended. Maybe:

  pcre:"/update\h+\w+\h+set/i"

Regards,
Markus


-------------------------------------------------------------------------
Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
Studies have shown that voting for your favorite open source project,
along with a healthy diet, reduces your potential for chronic lameness
and boredom. Vote Now at http://www.sourceforge.net/community/cca08
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users