<html><body bgcolor="#FFFFFF"><div>Yes, this rule has been redone and will be released shortly. </div><div><br></div><div>Thanks for all the reports, we appreciate them. <br><br><br><div>Sent from my iPhone</div></div><div><br>On Oct 1, 2010, at 3:20 PM, Tomas Heredia <<a href="mailto:tomas.heredia@...12297...">tomas.heredia@...12297...</a>> wrote:<br><br></div><div></div><blockquote type="cite"><div>

    It was trigerring a lot for me too.<br>
    I´ve removed it from my config.<br>
    <br>
    El 01/10/2010 04:08 p.m., Jefferson, Shawn escribió:
    <blockquote cite="mid:D05BDFB6A6F4EE43ABE62D1A7170AF3713D1B567C5@...391...4473..." type="cite">
      
      
      <!-- converted from rtf -->
      <style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
      <font size="2" face="Arial, sans-serif">
        <div>Anyone else notice this rule, 17494 triggering a lot
          today?  Or is it just me… it’s an old vulnerability from 2006.</div>
        <div><font size="3" face="Times New Roman, serif"> </font></div>
        <div><font size="3" face="Times New Roman, serif">alert tcp
            $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
            (msg:"WEB-CLIENT Microsoft Internet Explorer Long URL Buffer
            Overflow attempt"; flow:established,to_server;
            urilen:>260; content:"GET"; http_method;
            content:"HTTP|2F|1|2E|1|0D
            0A|"; metadata:service http; reference:bugtraq,19667;
            reference:cve,2006-3869; classtype:attempted-user;
            sid:17494; rev:1;)</font></div>
        <div><font size="3" face="Times New Roman, serif"> </font></div>
        <a moz-do-not-send="true" name="_MailAutoSig"></a>
        <div><font size="1" face="Verdana, sans-serif"><b>-- </b></font></div>
        <div><font size="1" face="Verdana, sans-serif"><b>Shawn
              Jefferson, IT Security</b>, <font face="Calibri,
              sans-serif">GCIH, GCFA<br>
            </font>British Columbia Ferry Services Inc.<br>
            Tel: (250) 978-1508<br>
            Fax: (250) 405-3533</font></div>
        <div><font size="3" face="Times New Roman, serif"><a moz-do-not-send="true" href="mailto:Shawn.Jefferson@...14448..."><font size="1" color="#0000ff" face="Calibri, sans-serif"><u>Shawn.Jefferson@...14534......</u></font></a><font size="1" color="#808080" face="Calibri, sans-serif">
            </font><font size="1" face="Calibri, sans-serif"><b>|</b></font><font size="1" color="#7f7f7f" face="Calibri, sans-serif"><b> </b></font><a moz-do-not-send="true" href="http://www.bcferries.com"><font size="1" color="#0000ff" face="Calibri, sans-serif"><u>www.bcferries.com</u></font></a><font size="2" face="Calibri, sans-serif">
            </font></font></div>
        <div><font size="3" face="Times New Roman, serif"> </font></div>
        <div><font size="3" face="Times New Roman, serif"> </font></div>
        <div><font size="3" face="Times New Roman, serif"> </font></div>
      </font>
      <pre wrap=""><fieldset class="mimeAttachmentHeader"></fieldset>
------------------------------------------------------------------------------
Start uncovering the many advantages of virtual appliances
and start using them to simplify application deployment and
accelerate your shift to cloud computing.
<a class="moz-txt-link-freetext" href="http://p.sf.net/sfu/novell-sfdev2dev"><a href="http://p.sf.net/sfu/novell-sfdev2dev">http://p.sf.net/sfu/novell-sfdev2dev</a></a></pre>
      <pre wrap=""><fieldset class="mimeAttachmentHeader"></fieldset>
_______________________________________________
Snort-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Snort-users@...4626...ceforge.net"><a href="mailto:Snort-users@lists.sourceforge.net">Snort-users@lists.sourceforge.net</a></a>
Go to this URL to change user options or unsubscribe:
<a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/snort-users"><a href="https://lists.sourceforge.net/lists/listinfo/snort-users">https://lists.sourceforge.net/lists/listinfo/snort-users</a></a>
Snort-users list archive:
<a class="moz-txt-link-freetext" href="http://www.geocrawler.com/redir-sf.php3?list=snort-users"><a href="http://www.geocrawler.com/redir-sf.php3?list=snort-users">http://www.geocrawler.com/redir-sf.php3?list=snort-users</a></a></pre>
    </blockquote>
    <br>
  

</div></blockquote><blockquote type="cite"><div><span>------------------------------------------------------------------------------</span><br><span>Start uncovering the many advantages of virtual appliances</span><br><span>and start using them to simplify application deployment and</span><br><span>accelerate your shift to cloud computing.</span><br><span><a href="http://p.sf.net/sfu/novell-sfdev2dev">http://p.sf.net/sfu/novell-sfdev2dev</a></span></div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Snort-users mailing list</span><br><span><a href="mailto:Snort-users@lists.sourceforge.net">Snort-users@lists.sourceforge.net</a></span><br><span>Go to this URL to change user options or unsubscribe:</span><br><span><a href="https://lists.sourceforge.net/lists/listinfo/snort-users">https://lists.sourceforge.net/lists/listinfo/snort-users</a></span><br><span>Snort-users list archive:</span><br><span><a href="http://www.geocrawler.com/redir-sf.php3?list=snort-users">http://www.geocrawler.com/redir-sf.php3?list=snort-users</a></span></div></blockquote></body></html>