[Snort-sigs] Problems with rules in web-clients.rules over the last two days

Russell Fulton r.fulton at ...575...
Mon May 14 17:40:51 EDT 2007


Hi folks

over the last two days I have been getting multiple errors in the above
file from CURRENT.  If I comment the offending rule then I get another
error where the same construct appears in another rule.  It looks as if
someone has tried to update a bunch of rules to use the exetentded REs
and bungled it.

example:

May 15 09:20:10 monitor-dmzo snort: FATAL ERROR:
/home/snort/Rules/rules/web-client.rules(711) : pcre compile of
"1([^>]\x00)*1(?P<q2>\x22\x00|\x27\x00|)1({\x00)?1(}\x00)?(?P=q2)(?=\s\x00|>\x00)"
failed at offset 15 : unrecognized character after (?

(? is the introducer for a extension and should be followed by one of
#,:,=,!,>,-,i,m,x

I updated snort to 2.6.1.5 just in case that was the problem.

Russell






More information about the Snort-sigs mailing list