Snort mailing list archives
[Snort-Devel] bug in http preprocessor and non ascii characters 2.8.6.1
From: matan monitz <mmonitz () gmail com>
Date: Wed, 16 Mar 2011 19:02:22 +0200
hello i am encountering runaway uri buffers when inspecting packets with non ascii characters in the uri what basically happens is that for some reason if the uri contains non printable letters (hebrew ansi from IE for instance) the uri buffer gets filled with header data resulting in false positives i haven't tested the buffers using the methods described in the recent blog post but have tested it with custom rules and was able to recreate the bug is this a known bug or some configuration option i'm missing? i can post the test pcaps and rules if needed
------------------------------------------------------------------------------ Colocation vs. Managed Hosting A question and answer guide to determining the best fit for your organization - today and in the future. http://p.sf.net/sfu/internap-sfd2d
_______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-devel
Current thread:
- [Snort-Devel] bug in http preprocessor and non ascii characters 2.8.6.1 matan monitz (Mar 16)
- Re: [Snort-Devel] bug in http preprocessor and non ascii characters 2.8.6.1 Bhagya Bantwal (Mar 16)
- Re: [Snort-Devel] bug in http preprocessor and non ascii characters 2.8.6.1 matan monitz (Mar 16)
- Re: [Snort-Devel] bug in http preprocessor and non ascii characters 2.8.6.1 Bhagya Bantwal (Mar 18)
- Re: [Snort-Devel] bug in http preprocessor and non ascii characters 2.8.6.1 matan monitz (Mar 16)
- Re: [Snort-Devel] bug in http preprocessor and non ascii characters 2.8.6.1 Joel Esler (Mar 16)
- Re: [Snort-Devel] bug in http preprocessor and non ascii characters 2.8.6.1 Ryan Jordan (Mar 16)
- Re: [Snort-Devel] bug in http preprocessor and non ascii characters 2.8.6.1 Bhagya Bantwal (Mar 16)