[Snort-sigs] Bad rule... Bad bad rule

Kreimendahl, Chad J Chad.Kreimendahl at ...361...
Tue Mar 9 09:33:10 EST 2004


Ok, who's been cutting and pasting?   Brian?

alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE
all_tab_privs access"; flow:to_server,established;
content:"all_tab_columns"; nocase; classtype:protocol-command-decode;
sid:1685; rev:3;)

Should be:

alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ORACLE
all_tab_privs access"; flow:to_server,established;
content:"all_tab_privs"; nocase; classtype:protocol-command-decode;
sid:1685; rev:4;)




More information about the Snort-sigs mailing list