Re: Bug in community ruleset rule (sid 975)

[Alex McDonnell <amcdonnell () sourcefire com>]

Reference was fixed and will be out shortly in rev 27 of the rule.

Thanks for pointing it out!

On Mon, Feb 8, 2021 at 5:06 AM Noah Dietrich <noah_dietrich () 86penny org>
wrote:

> While parsing the community-rules file, i found an incorrectly-formatted
> reference:url:
> the url is listed as:
>   support.microsoft.com/default.aspx?scid=kb*\;*EN-US*\;*q188806
> (you'll note the *\;* here which seems incorrect)
>
> The whole Rule is:
> # alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (
> msg:"SERVER-IIS Alternate Data streams ASP file access attempt";
> flow:to_server,established; http_uri; content:".asp|3A 3A 24|DATA",nocase;
> metadata:ruleset community; service:http; reference:bugtraq,149;
> reference:cve,1999-0278; reference:nessus,10362; reference:url,
> support.microsoft.com/default.aspx?scid=kb\;EN-US\;q188806
> <http://support.microsoft.com/default.aspx?scid=kb%5C;EN-US%5C;q188806>;
> classtype:web-application-attack; sid:975; rev:26; )
>
> Also: the Microsoft KB link is no longer available (since this cve is for
> NT4 i think). a valid URL for this CVE is:
>
> https://docs.microsoft.com/en-us/security-updates/securitybulletins/1998/ms98-003
>
>
> However, I'm not sure how useful it is to look for a 20 year old
> vulnerability on software that is this old.
>
> Noah
>
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs () lists snort org
> https://lists.snort.org/mailman/listinfo/snort-sigs
>
> Please visit http://blog.snort.org for the latest news about Snort!
>
> Please follow these rules:
> https://snort.org/faq/what-is-the-mailing-list-etiquette
>
> Visit the Snort.org to subscribe to the official Snort ruleset, make sure
> to stay up to date to catch the most <a href="
> https://snort.org/downloads/#rule-downloads";>emerging threats</a>!
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists snort org
https://lists.snort.org/mailman/listinfo/snort-sigs

Please visit http://blog.snort.org for the latest news about Snort!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a 
href=" https://snort.org/downloads/#rule-downloads";>emerging threats</a>!