[Snort-users] Rule causes a Segmentation Fault

SN ORT snort_on_acid at ...131...
Thu Dec 11 05:58:06 EST 2003

This rule causes a segmentation fault on one of my
sensors. The other sensor is not affected. Both are
the same version (2.0.4). 
alert tcp any any -> any 80 (uricontent:"%01@";
msg:"IE Web Redirect Vulnerability"; nocase;)
It likes this one however:

alert tcp any 80 -> any any (uricontent:"%01@";
msg:"IE Web Redirect Vulnerability"; nocase;)

Not that I would use the one above. I'm only concerned
with the first rule.
Why is it failing? Maybe it can't handle the load at
looking at every incoming HTTP packet? TIA!


Do you Yahoo!?
New Yahoo! Photos - easier uploading and sharing.

More information about the Snort-users mailing list