Emerging Threats ruleset error

["Jefferson, Shawn" <Shawn.Jefferson () bcferries com>]

Just got alerted (OSSEC!) that there is an error in an emerging threats rule:

Jan  5 15:45:18 xxxxx02 snort[4414]: FATAL ERROR: /etc/snort/rules/emerging.rules(8587) What is this "o"(0x6F) doing in 
your binary buffer?  Valid hex values only please! (0x0 - 0xF) Position: 14

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX ImageShack Toolbar Remote Code Execution"; 
flow:established,to_client; content:"clsid"; nocase; content:"DC922B67-FF61-455E-9D79-959925B6695C"; nocase; 
distance:0; content:"javascript|3a|document|2e|getElementById|28 27|"; content:"|2e|strategy"; distance:0; within:20; 
content:"javascript|3adocument.getElementById|28 27|"; distance:0; content:"|2e|target"; distance:0; within:20; 
pcre:"/<object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*DC922B67-FF61-455E-9D79-959925B6695C\s*}?\s*(.*)\>/si";
 classtype:attempted-user; reference:url,www.exploit-db.com/exploits/15601; sid:2012146; rev:4;)

PS. Apologies for posting on the Snort list, but I'm not a member of any ET lists, and since it caused Snort to stop 
running, thought it would might be useful for others too.

--
Shawn Jefferson


------------------------------------------------------------------------------
Learn how Oracle Real Application Clusters (RAC) One Node allows customers
to consolidate database storage, standardize their database environment, and, 
should the need arise, upgrade to a full multi-node Oracle RAC database 
without downtime or disruption
http://p.sf.net/sfu/oracle-sfdevnl

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users