[Snort-sigs] Missing sig...

Brian (Automail) bmc at ...95...
Sun Jan 20 09:35:07 EST 2002


On Sun, Jan 20, 2002 at 11:48:27AM -0500, a.h.s. boy wrote:
> I just noticed that neither your "Finished" nor "Unfinished" rule 
> explanations includes the "EXPLOIT ssh CRC32 overflow filler" rule. I 
> can't, unfortunately, provide too much information on it (except that it 
> generates a false positive every time I ssh to my server), but I thought 
> you might want to make sure it was properly listed.

Actually, I was not including the "disabled by default" signatures for 
browsing. I've changed this.

You still could have searched for the signature by entering in the sid.

http://www.snort.org/snort-db/sid.html?id=1325

-brian




More information about the Snort-sigs mailing list