Snort mailing list archives
Re: Emerging Threats ruleset error
From: Matthew Jonkman <jonkman () emergingthreatspro com>
Date: Wed, 5 Jan 2011 19:48:02 -0500
Fixed up, can you retest? We'd love to see you on the ET lists. There's a lot of relevant discussion there if you're using that ruleset. (We're not supposed to mention it over here :) ) Matt On Jan 5, 2011, at 6:59 PM, Jefferson, Shawn wrote:
Just got alerted (OSSEC!) that there is an error in an emerging threats rule: Jan 5 15:45:18 xxxxx02 snort[4414]: FATAL ERROR: /etc/snort/rules/emerging.rules(8587) What is this "o"(0x6F) doing in your binary buffer? Valid hex values only please! (0x0 - 0xF) Position: 14 alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX ImageShack Toolbar Remote Code Execution"; flow:established,to_client; content:"clsid"; nocase; content:"DC922B67-FF61-455E-9D79-959925B6695C"; nocase; distance:0; content:"javascript|3a|document|2e|getElementById|28 27|"; content:"|2e|strategy"; distance:0; within:20; content:"javascript|3adocument.getElementById|28 27|"; distance:0; content:"|2e|target"; distance:0; within:20; pcre:"/<object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*DC922B67-FF61-455E-9D79-959925B6695C\s*}?\s*(.*)\>/si"; classtype:attempted-user; reference:url,www.exploit-db.com/exploits/15601; sid:2012146; rev:4;) PS. Apologies for posting on the Snort list, but I'm not a member of any ET lists, and since it caused Snort to stop running, thought it would might be useful for others too. -- Shawn Jefferson ------------------------------------------------------------------------------ Learn how Oracle Real Application Clusters (RAC) One Node allows customers to consolidate database storage, standardize their database environment, and, should the need arise, upgrade to a full multi-node Oracle RAC database without downtime or disruption http://p.sf.net/sfu/oracle-sfdevnl_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
---------------------------------------------------- Matthew Jonkman Emergingthreats.net Emerging Threats Pro Open Information Security Foundation (OISF) Phone 765-807-8630 Fax 312-264-0205 http://www.emergingthreatspro.com http://www.openinfosecfoundation.org ---------------------------------------------------- PGP: http://www.jonkmans.com/mattjonkman.asc
------------------------------------------------------------------------------ Learn how Oracle Real Application Clusters (RAC) One Node allows customers to consolidate database storage, standardize their database environment, and, should the need arise, upgrade to a full multi-node Oracle RAC database without downtime or disruption http://p.sf.net/sfu/oracle-sfdevnl
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Emerging Threats ruleset error Jefferson, Shawn (Jan 05)
- Re: Emerging Threats ruleset error Matthew Jonkman (Jan 05)
- Re: Emerging Threats ruleset error Joel Esler (Jan 05)