RE: RE: arachNIDS, CVE, bugtraq

["L. Christopher Luther" <CLuther () Xybernaut com>]

Hack or not, it's been a useful feature when one is using IDScenter.  What,
if anything, will "-G" be replaced with???  

- Christopher


-----Original Message-----
From: Brian [mailto:bmc () snort org]
Sent: Saturday, November 16, 2002 5:01 PM
To: L. Christopher Luther
Cc: 'Jay Archibald'; 'snort-users () lists sourceforge net'
Subject: Re: [Snort-users] RE: arachNIDS, CVE, bugtraq


On Fri, Nov 15, 2002 at 03:39:57PM -0500, L. Christopher Luther wrote:
> I use the "-G url" command line parameter to cause Snort to reference the
> ids back to the alert message.  I get output something like this:  
>
> 11/15/02-09:13:47.755531  [**] [1:1243:6] WEB-IIS ISAPI .ida attempt -
> http://www.whitehats.com/info/IDS552 -
http://www.securityfocus.com/bid/1065
> - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0071 [**]
> [Classification: Web Application Attack] [Priority: 1] {TCP}
> 200.196.105.83:4571 -> xxx.xxx.xxx.xxx:80
>
> However, I don't know if this will work with ACID.  

FYI, We're removing the -G (G is for Ghetto) in the future.  Its a horrid
hack that I slung together.  Don't count on that feature being there in the
future.

-brian