possible fp on 17297

[matan monitz <mmonitz () gmail com>]

hello
i have been trying to investigate a possible fp for 17297 but i can't really
figure out what the sig is looking for

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SPECIFIC-THREATS McAfee
VirusScan on-access scanner long unicode filename handling buffer overflow
attempt"; flow:to_client,established; content:"|52 61 72 21 1A 07 00 CF 90
73 00 00 0D|"; content:"|E2 CA D4 B2 E2 CA D4 B2|"; distance:0; sid:17297;
rev:3;)
i get the first part ("|52 61 72 21 1A 07 00 CF 90 73 00 00 0D|"; ) thats a
rar file header but what is:* content:"|E2 CA D4 B2 E2 CA D4 B2|";?  *is it
suppose to be something in unicode?
how sure should i be regarding this signature?

------------------------------------------------------------------------------
Beautiful is writing same markup. Internet Explorer 9 supports
standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
Spend less time writing and  rewriting code and more time creating great
experiences on the web. Be a part of the beta today
http://p.sf.net/sfu/msIE9-sfdev2dev

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs