Problem with rule sid 33323

[Guillaume Daleux <guillaume.daleux () abovesecurity com>]

Hello all,

I have an error with rule sid 33323.

Error : failed at offset 3 : unrecognized character after (?<

Resolution : Update PCRE version (it works with PCRE version 7.8)

Bug details (debugging PCRE):
[root@DEV ~]# pcretest
PCRE version 6.6 06-Feb-2006

  re> 
"/(?<RS>\w+)\s?=\s?document\x2egetElementById\x28[\x22\x27]\w+[\x22\x27]\xx22\x27]\x29.*\k<RS>.DataSource\s?=\s?\k<OBJ>/smi"
Failed: unrecognized character after (?< at offset 4

Problem: I'm running CentOS  5.3 and the latest official PCRE version presents in the repository is 6.6

Question: Is there another way to write this rule and make it works without updating the PCRE version ?

Regards,

Guillaume DALEUX

------------------------------------------------------------------------------
Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
from Actuate! Instantly Supercharge Your Business Reports and Dashboards
with Interactivity, Sharing, Native Excel Exports, App Integration & more
Get technology previously reserved for billion-dollar corporations, FREE
http://pubads.g.doubleclick.net/gampad/clk?id=190641631&iu=/4140/ostg.clktrk

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!