[Snort-sigs] Possible False Positive on SID 2381???

Attached is a PCAP of the offending packet.  The destination was a webserver on 
our DMZ. 
The SID that fired is "WEB-MISC schema overflow attempt" with the listed 
affected system
being Checkpoint Firewall-1.  

When looking at the pcap payload i see "pdf" a couple of times.  "adobe" a 
couple of
times.  So i am guessing it's a false positive.  But i don't know.  I am still a
beginner.    

I am attaching the only other PCAP I have from the same source if that will 
help.  
(it triggered (http_inspect) BARE BYTE UNICODE ENCODING).

Again, i am not sure if this is a false positive or was an actual intrusion 
atempt (we
are patched and not affected by the supposed vuln anyway) but i would like to 
know!   

Any help/advice/requests for more info (that maybe i know know i have) are 
welcome and
appreciated!  

Side (dumb) question.  Say I was vulnerable to this checkpoint firewall attack. 
 Would a
packet destined to the webserver on the DMZ do damage to the firewall just 
because it
passes though it... or would the packet have to be destined for the actually 
firewall. 
Thanks for the help!

-Seth

  

=====



                
__________________________________ 
Do you Yahoo!? 
Check out the new Yahoo! Front Page. 
www.yahoo.com

checkpoint.log
Description: checkpoint.log

bare_byte.log
Description: bare_byte.log