[Snort-sigs] the signatures of same sid exist in web-php.rules.

Kei Takai takai-k at ...2713...
Mon Aug 9 02:30:04 EDT 2004


Hello,

I performed to download rules file version 2.0 from www.snort.org(
http://www.snort.org/dl/rules/snortrules-snapshot-2_0.tar.gz).

The signatures of same SID exist in web-php.rules file.

Line: 60
  SID: 2145
  MSG: WEB-PHP TextPortal admin.php default password (admin) attempt

Line: 133
  SID: 2145
  MSG: WEB-PHP TextPortal admin.php default password admin attempt

and

Line: 61
   SID: 2146
   MSG: WEB-PHP TextPortal admin.php default password (12345) attempt

Line: 131
   SID: 2146
   MSG: WEB-PHP TextPortal admin.php default password 12345 attempt

I want you to change only one may be defined by each signatures.
I think SID's value should be set uniquely.


Kei Takai




More information about the Snort-sigs mailing list