[Snort-sigs] false positive in sid 567

Brian bmc at ...95...
Thu Apr 15 07:43:04 EDT 2004


On Thu, Apr 15, 2004 at 10:55:15AM -0300, Federico Castañeda wrote:
> False Positives: A false positive was detected in Sendmail when subject text
> is rejected. Sample payload below.
> 
> 550 5.7.1 "-Fast.ac,ting.P`E^N`IS.EN_lar'ge_ment.pill;zkgosmcyvj"...Subject
> text rejected..

Yeah, that is a custom change to sendmail.  We are not modifying the
default sig to include that.  Feel free to use it on your own.

Brian




More information about the Snort-sigs mailing list