[Snort-sigs] duplicate rules (16412 and 16413) ?

Nerijus Krukauskas nkrukauskas at ...2420...
Thu Jun 17 06:32:14 EDT 2010

Are these two the duplicates of each other? OK, I admit I haven't
looked into the code (both are SO rules, and heck I've no idea if the
source _is_ available). But the message is the same and references
too. And they fire in sync.

WEB-CLIENT Microsoft PowerPoint invalid TextByteAtom remote code
execution attempt [sid 16412]
WEB-CLIENT Microsoft PowerPoint invalid TextCharsAtom remote code
execution attempt [sid 16413]


More information about the Snort-sigs mailing list