[Snort-sigs] false positives for sigs 2259 & 2260

lpj0508 at ...366... lpj0508 at ...366...
Tue Dec 30 07:50:22 EST 2003


i believe the above signatures are prone to trigger false positives. i've been getting this alerts since updating the rules last week. when i looked closely, i noticed the alerts were triggered because vrfy or expn (mixed upper and lower case) were found in the mail content.

is this experienced by others too?


New! Unlimited Access from the Netscape Internet Service.
Beta test the new Netscape Internet Service for only $1.00 per month until 3/1/04.
Sign up today at http://isp.netscape.com/register
Act now to get a personalized email address!

Netscape. Just the Net You Need.

More information about the Snort-sigs mailing list