[Snort-sigs] SID 663, SMTP rcpt to sed command attempt

Hugo van der Kooij hvdkooij at ...481...
Sun Jul 13 14:16:09 EDT 2003


On Sun, 13 Jul 2003, Nathan Bain wrote:

> The documentation for SID 663, SMTP rcpt to sed command attempt, says
> there are no known false positives.  However, Snort has given me several
> apparent false positives.

I can confirm these findings. While they happen once a week it seems the 
message is a false positive.

Hugo.

-- 
 All email sent to me is bound to the rules described on my homepage.
    hvdkooij at ...481...		http://hvdkooij.xs4all.nl/
	    Don't meddle in the affairs of sysadmins,
	    for they are subtle and quick to anger.





More information about the Snort-sigs mailing list