[Snort-devel] [Bleeding-sigs] Re: Snort 2.7 Segfaults w/bleeding-exploit

Matt Jonkman jonkman at ...2939...
Wed Jul 25 20:37:22 EDT 2007



Todd Wease wrote:
> 
> The correct syntax is
> 
> 1<>5     /* between 1 and 5 */
> 
> I don't think that '>1<5' was ever valid syntax.  It was just that Snort
> syntax error checking didn't catch it as invalid and was probably doing
> the wrong thing with it.

Aha! That explains it all. THanks Todd. Updating our rule to be correct.

Matt

-- 
--------------------------------------------
Matthew Jonkman
Bleeding Edge Threats
US Phone 765-429-0398
US Fax 312-264-0205
AUS Phone 61-42-4157-491
AUS Fax 61-29-4750-026
http://www.bleedingthreats.net
--------------------------------------------

PGP: http://www.bleedingthreats.com/mattjonkman.asc






More information about the Snort-devel mailing list