[Snort-sigs] Problems with rules in web-clients.rules over the last two days

Matthew Watchinski mwatchinski at ...435...
Tue May 15 17:16:13 EDT 2007


Additionally what version of lib pcre are you running?

-matt

Nigel Houghton wrote:
> On  0, Russell Fulton <r.fulton at ...575...> wrote:
>> Hi folks
>>
>> over the last two days I have been getting multiple errors in the above
>> file from CURRENT.  If I comment the offending rule then I get another
>> error where the same construct appears in another rule.  It looks as if
>> someone has tried to update a bunch of rules to use the exetentded REs
>> and bungled it.
>>
>> example:
>>
>> May 15 09:20:10 monitor-dmzo snort: FATAL ERROR:
>> /home/snort/Rules/rules/web-client.rules(711) : pcre compile of
>> "1([^>]\x00)*1(?P<q2>\x22\x00|\x27\x00|)1({\x00)?1(}\x00)?(?P=q2)(?=\s\x00|>\x00)"
>> failed at offset 15 : unrecognized character after (?
>>
>> (? is the introducer for a extension and should be followed by one of
>> #,:,=,!,>,-,i,m,x
>>
>> I updated snort to 2.6.1.5 just in case that was the problem.
> 
> I cannot duplicate the problem you are having. Could you please check
> the revision numbers for the following SIDs:
> 
>  sid:8851; rev:2;
>  sid:8847; rev:2;
>  sid:8855; rev:2;
>  sid:8849; rev:2;
>  sid:10467; rev:1;
> 





More information about the Snort-sigs mailing list