[Snort-devel] rules problem relating to offset?

Brian bmc at ...835...
Mon Mar 31 14:24:05 EST 2003


On Mon, Mar 31, 2003 at 03:12:02PM -0600, Kreimendahl, Chad J wrote:
> FATAL ERROR: snort.conf (858): Unable to parse as offset value string
> 
> and... line 858 is:
> 
> alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP list overflow
> attempt"; flow:established,to_server; content:" LIST |22 22| {
> "; nocase; byte_test:5,>,256,string,dec,relative;
> reference:nessus,10374; reference:cve,CAN-2000-0284;
> classtype:misc-attack; sid:18
> 45; rev:6;)

When you upgrade snort, you should upgrade your ruleset.

This was corrected before 2.0.0 rc1 went out.

alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP list overflow attempt"; flow:established,to_server; content:" LIST |22 22| {"; nocase; byte_test:5,>,256,0,string,dec,relative; reference:nessus,10374; reference:cve,CAN-2000-0284; classtype:misc-attack; sid:1845; rev:7;)

-brian




More information about the Snort-devel mailing list