[Snort-sigs] SID: 6922 from VRT set causing snort to fail to start

Mike Guiterman mike.guiterman at ...435...
Mon Mar 26 10:23:40 EDT 2007


Generally it's ok to post a VRT rule to this list for verification or 
discussion on errors, false positives, etc - or if you'd like to submit 
an improvement to a rule.    We'd also ask that when you're discussing 
an issue like this to please copy vrt at ...435... on the message.  
The team does monitor this list to get this type of data but I'd just 
like to make sure that the VRT sees the message.




Gentoo-Wally wrote:
> I'm sorry it is 9622 and not 6922. It is rev 1 and the message is "DOS
> Spiffit UDP denial of service attempt"
>
> For future reference, is it ok to post a rule to this list from the VRT set?
>
> Thx Wally
>
>
> On 3/24/07, Joel Esler <joel.esler at ...435...> wrote:
>   
>> what rule rev is  it?
>>
>>
>>
>> +---------------------------------------------------------------------+
>> Joel Esler                                         Security Consultant
>>     gpg key: http://demo.sourcefire.com/jesler.pgp.key
>> +---------------------------------------------------------------------+
>>
>>
>>
>>
>> On Mar 23, 2007, at 3:29 PM, Gentoo-Wally wrote:
>>
>> Hi,
>>
>> I'm running snort 2.6.0 and SID: 6922 from the VRT set is causing
>> snort to fail to start. It gives the following error...
>>
>> snort: ERROR: <rules file location removed> : pcre compile of
>> "^[\x00]?+" failed at offset 8 : nothing to repeat.
>>
>> Can anyone else verify this?
>>
>> Wally
>>
>> -------------------------------------------------------------------------
>> Take Surveys. Earn Cash. Influence the Future of IT
>> Join SourceForge.net's Techsay panel and you'll get the chance to share your
>> opinions on IT & business topics through brief surveys-and earn cash
>> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
>> _______________________________________________
>> Snort-sigs mailing list
>> Snort-sigs at lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/snort-sigs
>>
>>
>>
>>     
>
> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share your
> opinions on IT & business topics through brief surveys-and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs
>   


-- 

Mike Guiterman

Snort Community Manager

Sourcefire, Inc.

mguiterman at ...435...

(410)423-1930





More information about the Snort-sigs mailing list