[Snort-sigs] [Emerging-Sigs] request enhance old sid 3193 please

Matt Jonkman jonkman at ...829...
Sun Jul 29 17:40:00 EDT 2012


Good catch, making the change now. (2103193 in the ET set)

Matt

On Sun, Jul 29, 2012 at 7:31 PM, rmkml <rmkml at ...174...> wrote:
> Hi,
> Im request on old sid 3193 to enhance pcre,
>
> old:
>  pcre:"/.cmd\x22.*\x26.*/smi";
>
> new:
>  pcre:"/\.cmd\x22.*?\x26/Ui";
>
> Fire with this URI:
>  /a.cmd"a&
>  /a.cmd%22a&
>  /a.cmd"a%26
>  /a.cmd%22a%26
>
> Regards
> Rmkml
>
> http://twitter.com/rmkml
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at ...3694...
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
>
> Support Emerging Threats! Subscribe to Emerging Threats Pro
> http://www.emergingthreatspro.com
> The ONLY place to get complete premium rulesets for Snort 2.4.0 through
> Current!




More information about the Snort-sigs mailing list