[Snort-sigs] invalid references in snort rules

Michael Pacheco mpacheco at ...1936...
Mon Oct 6 11:15:10 EDT 2003

Also ...

Sid 108 is tagged in the current ruleset as "Unknown Datagram decoding
problem"  but sid 108 is  "BACKDOOR QAZ Worm Client Login access" on the
snort document site .. ???


-----Original Message-----
From: Mark McDonagh [mailto:markmormartin at ...1934...] 
Sent: Monday, October 06, 2003 1:57 PM
To: snort-sigs at lists.sourceforge.net
Subject: [Snort-sigs] invalid references in snort rules

Hello everybody,

I was recently testing the references for the rules and I found that the
following URLs don't seem to be valid:

http://www.tlsecurity.net/backdoor/Dagger.1.4.html (sid 104, 105)
http://www.bugtraq.org/dev/GOBBLES-12.txt (sid 1382) - I found a 
similarily-named document at 

http://labs.defcom.com/adv/2001/def-2001-31.txt (sid 1379)
http://www.w00w00.org/files/w00aimexp/ (sid 1393, 1752) - should be 
http://www.w00w00.org/files/exploits/w00aimexp/ instead
http://www.musiccity.com/technology.htm (sid 1383)

Also, there's a typo in rule 2126 (reference specifies bugtaq instead of

NetFort ISS Limited

This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
Snort-sigs mailing list
Snort-sigs at lists.sourceforge.net

More information about the Snort-sigs mailing list