[Snort-sigs] FPs on 1653 - WEB-CGI campus access

Nigel Houghton nigel at ...435...
Tue Jul 5 13:09:08 EDT 2005


On  0, Jeff Kell <jeff-kell at ...922...> allegedly wrote:
> I think someone has been over this already, but now that I'm seeing FPs, it doesn't appear to be fixed.  
> 
> 1653's message is "CGI-BIN campus access" and searches HTTP requests for uricontent:"/campus"; nocase;
> 
> In all the stated references, [nessus, cve, icat, bugtraq] this is campAs, not campUs.
> 
> Jeff

sid 847 looks for "campas" access.

The second may be meant to look for spelling errors :)

+--------------------------------------------------------------------+
     Nigel Houghton      Research Engineer       Sourcefire Inc.
                   Vulnerability Research Team

 I require a window seat and an inflight Happy Meal, and no pickles! 
 God help you if I find pickles!




More information about the Snort-sigs mailing list