Re: [Snort-Devel] bug in http preprocessor and non ascii characters 2.8.6.1

[Joel Esler <jesler () sourcefire com>]

Please see. 

http://www.snort.org/snort-downloads/submit-a-bug


Thank you. 

--
Sent from my iPhone
Forgive my misspellings and briefness

On Mar 16, 2011, at 1:02 PM, matan monitz <mmonitz () gmail com> wrote:

> hello
> i am encountering runaway uri buffers when inspecting packets with non ascii characters in the uri
> what basically happens is that for some reason if the uri contains non printable letters (hebrew ansi from IE for 
> instance) the uri buffer gets filled with header data resulting in false positives
> i haven't tested the buffers using the methods described in the recent blog post but have tested it with custom rules 
> and was able to recreate the bug
> is this a known bug or some configuration option i'm missing?
>  i can post the test pcaps and rules if needed
>
> ------------------------------------------------------------------------------
> Colocation vs. Managed Hosting
> A question and answer guide to determining the best fit
> for your organization - today and in the future.
> http://p.sf.net/sfu/internap-sfd2d
> _______________________________________________
> Snort-devel mailing list
> Snort-devel () lists sourceforge net
> https://lists.sourceforge.net/lists/listinfo/snort-devel

------------------------------------------------------------------------------
Colocation vs. Managed Hosting
A question and answer guide to determining the best fit
for your organization - today and in the future.
http://p.sf.net/sfu/internap-sfd2d
_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel