[Snort-sigs] invalid references in snort rules

Michael Pacheco mpacheco at ...1936...
Mon Oct 6 11:15:10 EDT 2003


Also ...

Sid 108 is tagged in the current ruleset as "Unknown Datagram decoding
problem"  but sid 108 is  "BACKDOOR QAZ Worm Client Login access" on the
snort document site .. ???

Mike

-----Original Message-----
From: Mark McDonagh [mailto:markmormartin at ...1934...] 
Sent: Monday, October 06, 2003 1:57 PM
To: snort-sigs at lists.sourceforge.net
Subject: [Snort-sigs] invalid references in snort rules

Hello everybody,

I was recently testing the references for the rules and I found that the
following URLs don't seem to be valid:

http://www.tlsecurity.net/backdoor/Dagger.1.4.html (sid 104, 105)
http://www.bugtraq.org/dev/GOBBLES-12.txt (sid 1382) - I found a 
similarily-named document at 
http://www.attrition.org/security/advisory/gobbles/GOBBLES-12.txt

http://labs.defcom.com/adv/2001/def-2001-31.txt (sid 1379)
http://www.w00w00.org/files/w00aimexp/ (sid 1393, 1752) - should be 
http://www.w00w00.org/files/exploits/w00aimexp/ instead
http://www.musiccity.com/technology.htm (sid 1383)

Also, there's a typo in rule 2126 (reference specifies bugtaq instead of
bugtraq).



Regards
Mark
-- 
NetFort ISS Limited




-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-sigs mailing list
Snort-sigs at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs




More information about the Snort-sigs mailing list