[Snort-devel] [ snort-Bugs-502375 ] Evasion for Domino Servers

noreply at ...12... noreply at ...12...
Fri Jan 11 11:17:05 EST 2002


Bugs item #502375, was opened at 2002-01-11 08:37
You can respond by visiting: 
http://sourceforge.net/tracker/?func=detail&atid=103357&aid=502375&group_id=3357

Category: None
Group: None
Status: Open
Resolution: None
Priority: 5
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Nobody/Anonymous (nobody)
Summary: Evasion for Domino Servers

Initial Comment:
In web-misc.rules, there are 2 rules for Lotus servers.
The 2 rules 
are using ? before the method name, but in practice, the sign "!" can 
be used as well.

This allow to evade Snort easily on theses 2 
rules. 


Nicolas Gregoire
Exaprobe

----------------------------------------------------------------------

You can respond by visiting: 
http://sourceforge.net/tracker/?func=detail&atid=103357&aid=502375&group_id=3357




More information about the Snort-devel mailing list