Re: [Snort-sigs] New adobe vulnerability

Frank Knobbe <frank@knobbe.us> wrote:
> On Fri, 2004-08-20 at 10:37, nnposter@users.sourceforge.net wrote:
> > Yes. Only uricontent is preprocessed with http_inspect. content and pcre
> > are not.
>
> Okay, so I would assume that all HTTP related rules should be crafted
> with [uri]content instead of pcre then..... to take advantage of the
> HTTP normalization by the preprocessor.

Only uricontent takes advantage of http_inspect, not content.

> In other words, pcre based rules would be easy to evade by various HTTP
> encodings, right?

As you have said, the URI normalization is a tremendous help. On the 
other hand both uricontent and content lack the precision of PCRE so 
in some cases it makes sense to start with uricontent and add PCRE to 
weed out false positives.

You can request PCRE matching against normalized URIs by specifying 
undocumented modifier "U", such as:

    pcre:"/foo.+\.pdf\x00.+bar/iU";

but the performance issue is still there.

Cheers,
nnposter


-------------------------------------------------------
SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs