[Snort-sigs] Re: Community rules, 100000279? Pcre error? Signature needs tightening up?

 0, Blake Hartstein <bhartstein@demarc.com>:
> There is an error in the pcre for this rule,
>
> It was
> pcre:"/filename=\s*[\x2ewab]/smi";
>
> which happens to be a character class around [\x2ewab].
>
> It should be
> pcre:"/filename=\s*\x2ewab/smi";
>
> This is the reason for these false positives.

Good spot, didn't pay attention to that too much, thanks. We'll get that
fixed.

It was going to be /filename=\s*\x2e(w|p)ab/ but that seems a little
excessive.

+--------------------------------------------------------------------+
     Nigel Houghton      Research Engineer       Sourcefire Inc.
                   Vulnerability Research Team

         There is no theory of evolution, just a list
            of creatures Vin Diesel allows to live.


-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs