[Snort-sigs] false positives for sigs 2259 & 2260

lpj0508 at ...366... lpj0508 at ...366...
Tue Dec 30 07:50:22 EST 2003


hi,

i believe the above signatures are prone to trigger false positives. i've been getting this alerts since updating the rules last week. when i looked closely, i noticed the alerts were triggered because vrfy or expn (mixed upper and lower case) were found in the mail content.

is this experienced by others too?

lpj

__________________________________________________________________
New! Unlimited Access from the Netscape Internet Service.
Beta test the new Netscape Internet Service for only $1.00 per month until 3/1/04.
Sign up today at http://isp.netscape.com/register
Act now to get a personalized email address!

Netscape. Just the Net You Need.




More information about the Snort-sigs mailing list