[Snort-sigs] Re: Community rules, 100000279? Pcre error? Signature needs tightening up?

Nigel Houghton wrote:
>  0, Michael Scheidell <scheidell@secnap.net>:
>   
> > Snort 2.4.4, FREEBSD 4.11.
> >
> > community-smtp.rules:alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25
> > (msg:"COMMUNITY SMTP Incoming WAB attachment"; flow:to_server,
> > established; content:"Content-Disposition|3A|"; nocase;
> > pcre:"/filename=\s*[\x2ewab]/smi"; reference:cve,2006-0014;
> > reference:url,www.microsoft.com/technet/security/bulletin/MS06-016.mspx;
> > classtype:suspicious-filename-detect; sid:100000279; rev:1;)
> >
> > I see content-disposition at 4e0, filename at 510, I don't see the .wab:
> > (it is searching for Content-Disposition:.*filename=\s*.*\.wab  right?)
> >     
>  
> Almost, it is looking for Content-Disposition: followed by
> filename=<whatever>.wab
>
> What about the rest of the stream data? This is just one packet right?
>  
>   
I don't know, are you telling me at any subsequent packet in the stream 
could trigger it?

I thought that you had to have a signature match in the packet.


--
Michael Scheidell, CTO
SECNAP Network Security
561-999-5000, x 1131