duplicate rules (16412 and 16413) ?

[Nerijus Krukauskas <nkrukauskas () gmail com>]

Are these two the duplicates of each other? OK, I admit I haven't
looked into the code (both are SO rules, and heck I've no idea if the
source _is_ available). But the message is the same and references
too. And they fire in sync.

WEB-CLIENT Microsoft PowerPoint invalid TextByteAtom remote code
execution attempt [sid 16412]
WEB-CLIENT Microsoft PowerPoint invalid TextCharsAtom remote code
execution attempt [sid 16413]

-- 
http://nk99.org/

------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate 
GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the 
lucky parental unit.  See the prize list and enter to win: 
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs