[Snort-sigs] False positive for #0-(1-140)

Mark Lidstone mlidstone at ...2697...
Wed Aug 4 13:37:13 EDT 2004

# This is a template for submitting snort signature descriptions to
# the snort.org website
# Ensure that your descriptions are your own
# and not the work of others.  References in the rules themselves
# should be used for linking to other's work. 
# If you are unsure of some part of a rule, use that as a commentary
# and someone else perhaps will be able to fix it.
# $Id$




Detailed Information:

Affected Systems:

Attack Scenarios:

Ease of Attack:

False Positives:
This rule has been seen to generate false positives on a mail server
when valid emails passing through the server contain bug reports and the
like that mention the appropriate string (uid=???gid=???).
False Negatives:

Corrective Action:


Additional References:

Mark Lidstone
IT and Network Support Administrator

BMT SeaTech Ltd
Grove House, Meridians Cross, 7 Ocean Way
Ocean Village, Southampton.  SO14 3TJ. UK
Tel: +44 (0)23 8063 5122         
Fax: +44 (0)23 8063 5144

E-Mail:  mailto:mark.lidstone at ...2697...
Website: www.bmtseatech.co.uk
Confidentiality Notice and Disclaimer: 
The contents of this e-mail and any attachments are intended only for
use of the e-mail addressee(s) shown. If you are not that person, or one
of those persons, you are not allowed to take any action based upon it
to copy it, forward, distribute or disclose the contents of it and you
should please delete it from your system. BMT SeaTech Limited does not
accept liability for any errors or omissions in the context of this
or its attachments which arise as a result of Internet transmission, nor
accept liability for statements which are those of the author and not
clearly made on behalf of BMT SeaTech Limited.

More information about the Snort-sigs mailing list