[Snort-sigs] False Positive 1:1478

This might just be stupid but I though I would submit it anyways.
 
 
 
 
Here is the info from the template.
Rule:  
web-cgi.rules:alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS
(msg:"WEB-CGI swc access"; flow:to_server,established;
uricontent:"/swc"; nocase; reference:nessus,10493;
classtype:attempted-recon; sid:1478; rev:5;)
 
--
Sid:1:1478
 
--
Summary: any cgi link with the letters /swc are triggering the alert.
There has to be more characters to narrow it down. Or possible after
characters to exclude. 
 
--
Impact:
 
 
--
Detailed Information:
 
--
Affected Systems:
Anyone with the letters '/swc' in a cgi path
--
Attack Scenarios:
 
--
Ease of Attack:
 
--
False Positives:
when customer gets jpg file alert is triggered.
 
GET /userpages/swcreations/images/floralbg.jpg HTTP/1.1
 
--
False Negatives:
 
--
Corrective Action:
 
--
Contributors:
 
-- 
Additional References:

http://www.nessus.org/plugins/index.php?view=single&id=10493 

 

Joseph Balden

Vision Bankcard IT 

801-805-9006

 

 

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs