[Snort-sigs] false positive for SID 1288

flatline flatline at ...2714...
Mon Aug 9 06:27:01 EDT 2004


I have come across what probably is a false positive for SID 1288. I 
started to encounter numerous Snort alerts for this SID, and when I 
researched some of them I noticed that the clients were requesting a file, 
rather than attempting to exploit my server. I did a little Google search 
and I came up with the following URL which explained the source of the 
alerts: http://www.webmasterworld.com/forum39/2158.htm

I hope I've provided enough information for you to update the rule, but 
feel free to contact me if you need additional data.


- flatline
-------------- next part --------------

Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.733 / Virus Database: 487 - Release Date: 02-08-2004

More information about the Snort-sigs mailing list