[Snort-sigs] Missing sig...

Brian (Automail) bmc at ...95...
Sun Jan 20 09:35:07 EST 2002

On Sun, Jan 20, 2002 at 11:48:27AM -0500, a.h.s. boy wrote:
> I just noticed that neither your "Finished" nor "Unfinished" rule 
> explanations includes the "EXPLOIT ssh CRC32 overflow filler" rule. I 
> can't, unfortunately, provide too much information on it (except that it 
> generates a false positive every time I ssh to my server), but I thought 
> you might want to make sure it was properly listed.

Actually, I was not including the "disabled by default" signatures for 
browsing. I've changed this.

You still could have searched for the signature by entering in the sid.



More information about the Snort-sigs mailing list