[Snort-sigs] False negative in 3087.1 (WEB-IIS w3who.dll buffer overflow attempt)

Frank Knobbe frank at ...1978...
Wed Feb 2 23:40:22 EST 2005


On Wed, 2005-02-02 at 23:08 -0600, Nigel Houghton wrote:

> > However, pcre:"/http\:\/\/www/U"; will not.
> > 
> > Seems that this is written according to manual, yet /U breaks the rule.
> > Any idea why?
> 
>   "Match the _decoded_ URI buffers (Similar to _uricontent_)"


Uhm... yeah? http://www in... so what is that decoded to? Other than
http://www?

Perhaps I'm not seeing the tree at the end of the tunnel... ;)
Later,
Frank
 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20050202/bf9badd5/attachment.sig>


More information about the Snort-sigs mailing list