[Snort-users] Problem with rule sid 33323

Guillaume Daleux guillaume.daleux at ...13827...
Thu Feb 19 09:59:59 EST 2015

Hello all,

I have an error with rule sid 33323.

Error : failed at offset 3 : unrecognized character after (?<

Resolution : Update PCRE version (it works with PCRE version 7.8)

Bug details (debugging PCRE):
[root at ...17102... ~]# pcretest
PCRE version 6.6 06-Feb-2006

  re> "/(?<RS>\w+)\s?=\s?document\x2egetElementById\x28[\x22\x27]\w+[\x22\x27]\xx22\x27]\x29.*\k<RS>.DataSource\s?=\s?\k<OBJ>/smi"
Failed: unrecognized character after (?< at offset 4

Problem: I'm running CentOS  5.3 and the latest official PCRE version presents in the repository is 6.6

Question: Is there another way to write this rule and make it works without updating the PCRE version ?


Guillaume DALEUX

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150219/e7576828/attachment.html>

More information about the Snort-users mailing list