Snort mailing list archives
Re: Defect on rule 13514
From: Joel Esler <joel.esler () mac com>
Date: Fri, 11 Jul 2008 11:22:47 -0400
This discussion might be more effective on the Snort-sigs list. J On Jul 11, 2008, at 9:56 AM, Markus Lude wrote:
On Fri, Jul 11, 2008 at 07:23:21AM -0500, Jack Pepper wrote:The PCRE in 13514 looks like this:pcre:"/update[^\n]*set/i";and so picks up all kinds of stuff. I suspect you meant to catch the syntax:update[space][tablename][space]setRight? Might I suggest a PCRE that looks like this:pcre:"/update\h\w\hset/i"This is probably not what you intended. Maybe: pcre:"/update\h+\w+\h+set/i" Regards, Markus ------------------------------------------------------------------------- Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW! Studies have shown that voting for your favorite open source project, along with a healthy diet, reduces your potential for chronic lameness and boredom. Vote Now at http://www.sourceforge.net/community/cca08 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------- Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW! Studies have shown that voting for your favorite open source project, along with a healthy diet, reduces your potential for chronic lameness and boredom. Vote Now at http://www.sourceforge.net/community/cca08 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Defect on rule 13514 Jack Pepper (Jul 11)
- Re: Defect on rule 13514 Markus Lude (Jul 11)
- Re: Defect on rule 13514 Joel Esler (Jul 11)
- Re: Defect on rule 13514 Markus Lude (Jul 11)