-----Original Message-----
From: snort-sigs-admin@lists.sourceforge.net
[mailto:snort-sigs-admin@lists.sourceforge.net] On Behalf Of
Sourcefire VRT
Sent: Wednesday, April 12, 2006 1:21 PM
To: snort-sigs mailinglist
Subject: [Snort-sigs] Snort Community Rules Update
This message is to announce the availability of an update for the
Sourcefire community rule set, which can be downloaded free
of cost or
registration from http://www.snort.org/pub-bin/downloads.cgi.
This update fixes a false positive on SID 100000279, which
detects WAB
(Windows Address Book) transfers over SMTP. Sourcefire would like to
thank Blake Hartstein for pointing out this problem.
Get the attributions right ;-)
-----Original Message-----
From: snort-sigs-admin@lists.sourceforge.net
[mailto:snort-sigs-admin@lists.sourceforge.net] On Behalf Of Michael
Scheidell
Sent: Wednesday, April 12, 2006 7:54 AM
To: snort-sigs@lists.sourceforge.net
Subject: [Snort-sigs] Community rules, 100000279? Pcre error? Signature
needs tightening up?
Snort 2.4.4, FREEBSD 4.11.
community-smtp.rules:alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25
(msg:"COMMUNITY SMTP Incoming WAB attachment"; flow:to_server,
established; content:"Content-Disposition|3A|"; nocase;
pcre:"/filename=\s*[\x2ewab]/smi"; reference:cve,2006-0014;
reference:url,www.microsoft.com/technet/security/bulletin/MS06-016.mspx;
classtype:suspicious-filename-detect; sid:100000279; rev:1;)
I see content-disposition at 4e0, filename at 510, I don't see the .wab:
(it is searching for Content-Disposition:.*filename=\s*.*\.wab right?)
-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
