[Snort-sigs] Extra text in sid 1378

Chip Kelly Chip.Kelly at ...538...
Fri Apr 19 18:05:37 EDT 2002


While writing a parsing program, one of our developers noticed an extra bracket in 1378:

alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP wu-ftp file completion att
empt {"; flags:A+; content:"{"; content:!"}"; reference:url,archives.neohapsis.co
m/archives/vulnwatch/2001-q4/0059.html; sid:1378; rev:1;)

I've removed it in my ftp.rules file, can it be corrected in the master?

alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP wu-ftp file completion att
empt "; flags:A+; content:"{"; content:!"}"; reference:url,archives.neohapsis.co
m/archives/vulnwatch/2001-q4/0059.html; sid:1378; rev:1;) 

chip
----
Chip Kelly, GCIA, GCIH
Systems and Information Security Manager
SAS Institute Inc.
Chip.Kelly at ...538...	RA334
voice:  919-531-7033	fax:919-677-4444
mobile: 919-606-8230	




More information about the Snort-sigs mailing list