[Snort-devel] [Snort-Devel] bug in http preprocessor and non ascii characters

matan monitz mmonitz at ...2499...
Wed Mar 16 13:02:22 EDT 2011

i am encountering runaway uri buffers when inspecting packets with non ascii
characters in the uri
what basically happens is that for some reason if the uri contains non
printable letters (hebrew ansi from IE for instance) the uri buffer gets
filled with header data resulting in false positives
i haven't tested the buffers using the methods described in the recent blog
post but have tested it with custom rules and was able to recreate the bug
is this a known bug or some configuration option i'm missing?
 i can post the test pcaps and rules if needed
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20110316/76c36228/attachment.html>

More information about the Snort-devel mailing list