[Snort-devel] I hope this is not off-topic, but!!

From: John D. <lists(at)webcrunchers.com>
Date: Wed Feb 19 2003 - 17:35:07 EST

A lot of us are contractors, setting up IDS's for clients migrating from WinBlows.

Because exploits are discovered so frequently, we automate our systems to update our rules from "snort.org". As it currently stands, some of these rules crash snort.

Under Deleted-Rules, rule #113 crashes. It's in the "deleted rules". Rule #1620 used to be commented out because it didn't work. But when they copied it over to "Deleted-Rules", they uncommented it. I assume that perhaps someone might have discovered it by now and fixed it. In case they didn't, I'm bringing it to the attention on this list, in the hopes that someone might want to check it out.

If my claim is found out to be valid, then great, lets fix it. If not, then I certainly would want to know why a specific rule crashes Snort.

My request, is to please don't change the rule before moving them into the "Deleted-Rules" directory. We've noticed the rules were changed before getting moved into this directory. Some of our clients who use Snort have been complaining it crashes snort when they try to load in some rules from the "Deleted-Rules" directory, which apparently has some rules they think they need.

If at all possible, would you please make sure these rules work after they are placed in the rules library?

Thanx guys...

Just reply to this Email....

John

---

This SF.net email is sponsored by: SlickEdit Inc. Develop an edge. The most comprehensive and flexible code editor you can use. Code faster. C/C++, C#, Java, HTML, XML, many more. FREE 30-Day Trial. www.slickedit.com/sourceforge

---

Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel Received on Wed Feb 19 17:45:02 2003