[Snort-sigs] FPs on 1653 - WEB-CGI campus access

Jeff Kell jeff-kell at ...922...
Tue Jul 5 12:57:24 EDT 2005


I think someone has been over this already, but now that I'm seeing FPs, it doesn't appear to be fixed.  

1653's message is "CGI-BIN campus access" and searches HTTP requests for uricontent:"/campus"; nocase;

In all the stated references, [nessus, cve, icat, bugtraq] this is campAs, not campUs.

Jeff





More information about the Snort-sigs mailing list