[Snort-sigs] Bug in 1934.6? (POP2 FOLD overflow attempt)

Brian bmc at ...95...
Wed Jul 7 07:30:25 EDT 2004


On Tue, Jul 06, 2004 at 04:00:43PM -0600, nnposter at ...592... wrote:
> In a recent update of 1934 to revision 6 relative clause isdataat
> has been moved in front of the content clause. The net effect is
> that isdataat no longer tests the length of the payload after
> the content clause (FOLD command) but simply acts as a dsize clause.

Nah, some oddness from my rule "optomizing".  It will be fixed
shortly.

Brian




More information about the Snort-sigs mailing list