Re: [Snort-sigs] Problems with rules in web-clients.rules over the last two days

Additionally what version of lib pcre are you running?

-matt

Nigel Houghton wrote:
> On  0, Russell Fulton <r.fulton@auckland.ac.nz> wrote:
> > Hi folks
> >
> > over the last two days I have been getting multiple errors in the above
> > file from CURRENT.  If I comment the offending rule then I get another
> > error where the same construct appears in another rule.  It looks as if
> > someone has tried to update a bunch of rules to use the exetentded REs
> > and bungled it.
> >
> > example:
> >
> > May 15 09:20:10 monitor-dmzo snort: FATAL ERROR:
> > /home/snort/Rules/rules/web-client.rules(711) : pcre compile of
> > "1([^>]\x00)*1(?P<q2>\x22\x00|\x27\x00|)1({\x00)?1(}\x00)?(?P=q2)(?=\s\x00|>\x00)"
> > failed at offset 15 : unrecognized character after (?
> >
> > (? is the introducer for a extension and should be followed by one of
> > #,:,=,!,>,-,i,m,x
> >
> > I updated snort to 2.6.1.5 just in case that was the problem.
>
> I cannot duplicate the problem you are having. Could you please check
> the revision numbers for the following SIDs:
>
>  sid:8851; rev:2;
>  sid:8847; rev:2;
>  sid:8855; rev:2;
>  sid:8849; rev:2;
>  sid:10467; rev:1;


-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs