[Snort-sigs] Problems with rules in web-clients.rules over the last two days

Nigel Houghton nigel at ...435...
Mon May 14 18:12:15 EDT 2007

On  0, Russell Fulton <r.fulton at ...575...> wrote:
> Hi folks
> over the last two days I have been getting multiple errors in the above
> file from CURRENT.  If I comment the offending rule then I get another
> error where the same construct appears in another rule.  It looks as if
> someone has tried to update a bunch of rules to use the exetentded REs
> and bungled it.
> example:
> May 15 09:20:10 monitor-dmzo snort: FATAL ERROR:
> /home/snort/Rules/rules/web-client.rules(711) : pcre compile of
> "1([^>]\x00)*1(?P<q2>\x22\x00|\x27\x00|)1({\x00)?1(}\x00)?(?P=q2)(?=\s\x00|>\x00)"
> failed at offset 15 : unrecognized character after (?
> (? is the introducer for a extension and should be followed by one of
> #,:,=,!,>,-,i,m,x
> I updated snort to just in case that was the problem.

I cannot duplicate the problem you are having. Could you please check
the revision numbers for the following SIDs:

 sid:8851; rev:2;
 sid:8847; rev:2;
 sid:8855; rev:2;
 sid:8849; rev:2;
 sid:10467; rev:1;

Nigel Houghton
Office Linebacker

More information about the Snort-sigs mailing list