[Snort-sigs] Add false positive entry to rule 1:2003

Lyndon Tiu ltiu at ...2753...
Tue Aug 31 07:02:10 EDT 2004


Rule:  MS-SQL Worm propagation attempt

--
Sid: 1:2003

--
Summary:

--
Impact:

--
Detailed Information:

--
Affected Systems:

--
Attack Scenarios:

--
Ease of Attack:

--
False Positives:

ICMP port 1434 unreacheable packets are sent out triggering an alert when the packet is benign. Please see attached ACID report.

--
False Negatives:

--
Corrective Action:

--
Contributors:

-- 
Additional References:


--
Lyndon Tiu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20040831/f8c07d0a/attachment.htm>


More information about the Snort-sigs mailing list