Snort mailing list archives
duplicate rules (16412 and 16413) ?
From: Nerijus Krukauskas <nkrukauskas () gmail com>
Date: Thu, 17 Jun 2010 13:32:14 +0300
Are these two the duplicates of each other? OK, I admit I haven't looked into the code (both are SO rules, and heck I've no idea if the source _is_ available). But the message is the same and references too. And they fire in sync. WEB-CLIENT Microsoft PowerPoint invalid TextByteAtom remote code execution attempt [sid 16412] WEB-CLIENT Microsoft PowerPoint invalid TextCharsAtom remote code execution attempt [sid 16413] -- http://nk99.org/ ------------------------------------------------------------------------------ ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit. See the prize list and enter to win: http://p.sf.net/sfu/thinkgeek-promo _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs
Current thread:
- duplicate rules (16412 and 16413) ? Nerijus Krukauskas (Jun 17)
- Re: duplicate rules (16412 and 16413) ? Rodrigo Montoro(Sp0oKeR) (Jun 17)
- Re: duplicate rules (16412 and 16413) ? Nerijus Krukauskas (Jun 17)
- Re: duplicate rules (16412 and 16413) ? Rodrigo Montoro(Sp0oKeR) (Jun 17)