[Snort-sigs] sid 100000494 and 100000495

Hello,

if I haven't missed something with the uricontent modifier of the
pcre keyword, there is possibly a typo in the following two
rules:


community-web-php.rules: sid:100000494; rev:1;

        pcre:"/$s_file_name(=|\x3f)\x3c[^\n]+\x3e/Ui";


community-web-php.rules: sid:100000495; rev:1;

        pcre:"/$file_name(=|\x3f)\x3c[^\n]+\x3e/Ui";


'$' usually means "end of string". This should presumably have been 
escaped by a backslash. I cannot see, that the uricontent modifier
changes this. And the rule does not have a modifier for
multiline mode. So I would say, a backslash should be added
in both cases.

Bye, bye,

Juergen




-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs