[Snort-devel] [Snort-Devel] bug in http preprocessor and non ascii characters

Joel Esler jesler at ...402...
Wed Mar 16 13:26:27 EDT 2011

Please see. 


Thank you. 

Sent from my iPhone
Forgive my misspellings and briefness

On Mar 16, 2011, at 1:02 PM, matan monitz <mmonitz at ...2499...> wrote:

> hello
> i am encountering runaway uri buffers when inspecting packets with non ascii characters in the uri
> what basically happens is that for some reason if the uri contains non printable letters (hebrew ansi from IE for instance) the uri buffer gets filled with header data resulting in false positives
> i haven't tested the buffers using the methods described in the recent blog post but have tested it with custom rules and was able to recreate the bug
> is this a known bug or some configuration option i'm missing?
>  i can post the test pcaps and rules if needed
> ------------------------------------------------------------------------------
> Colocation vs. Managed Hosting
> A question and answer guide to determining the best fit
> for your organization - today and in the future.
> http://p.sf.net/sfu/internap-sfd2d
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel

More information about the Snort-devel mailing list