[Snort-sigs] Error in oracle rule...

I'm not certain where the right place to send bug reports in rules to is,
and haven't been able to find specific data, so I'll try here.

I think that the oracle 'user name buffer overflow attempt' rule (sid 2650) 
is wrong and does not check for the correct string.

It currently reads (relevant snippet):

content:"|28|user="; nocase; isdataat:1000,relative; content:!"|22|"; 
within:1000

0x28 = (
0x22 = "

... which is basically saying to match on the string "(user=" if there's not
a quote within the next thousand characters.

What I think it's *supposed* to do is to match if there's not a closing
parenthesis within the next thousand characters, since the string used
in actual requests is "(user=<username>)". 

So I think the rule should actually be (again, relevant snippet):

content:"|28|user="; nocase; isdataat:1000,relative; content:!"|29|"; 
within:1000

Thanks for your attention.

-jay

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs