[Snort-sigs] Error in misc.rules Oracle

Nate Neely nate at ...761...
Fri Aug 16 21:52:02 EDT 2002


There is an error on sid:1693 Oracle create table attempt - it is looking
for "drop table" in the content instead of the appropriate "create table".
So it is triggered by same content as sid:1692 - "drop table"

alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE
drop table attempt"; flags:A+; content:"drop table"; nocase;
classtype:protocol-command-decode; sid:1692; rev:3;)
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE
create table attempt"; flags:A+; content:"drop table"; nocase;
classtype:protocol-command-decode; sid:1693; rev:3;)



Nate Neely      /"\   ASCII Ribbon campaign
                \ /   against E-Mail in
                 X    HTML and proprietary
                / \   formats





More information about the Snort-sigs mailing list