[Snort-sigs] Rules stuff

Dana Powers dana at ...107...
Thu Sep 13 18:38:02 EDT 2001


A few minor problems with cve references:

in web-misc.rules:

sid 1051 has 'reference:cve,CVE-CAN-2001-0075;' should be
'reference:cve,CAN-2001-0075;'
sid 1079 has 'reference:cve, cve-2000-0869;' this would be nicer as
'reference:cve,CVE-2000-0869;'
sid 1160 has 'reference:cve,CVE-20000236;' should be
'reference:cve,CVE-2000-0236;'

in exploit.rules

both sid 303 and 314 have 'reference:cve,CAN-2000-10;' which is not
correctly formatted ( CAN-XXXX-XXXX ), and isnt correct for either alert (
im not sure what the correct one is ).
sid 294 has 'reference:cve,CVE-1999-004;' not correct CVE format, perhaps
'reference:cve,CAN-1999-0004;' ?

in dns.rules:

sid 252 has 'reference:cve,CVE-1999-009;' - improperly formatted, possibly
CVE-1999-0009 ?

in netbios.rules:

sid 530 has 'reference:cve,CVE-CVE-2000-0347;' - shound be
'reference:cve,CVE-2000-0347;'


Sorry no patch, Im not actually certain what the best resolution is for most
of these - but I did notice a problem.
dpk





More information about the Snort-sigs mailing list