Project

General

Profile

Actions
Copy link

Bug #227

closed

strange FP on suricata v101/100

Added by rmkml rmkml over 14 years ago. Updated about 14 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Anoop Saldanha
Target version:
1.1beta1
Affected Versions:
Effort:
Difficulty:
Label:

Description

Hi,
I have a strange FP with theses two sigs:
alert tcp any 80 -> any any (msg:"http reply 1"; flow:to_client,established; content:"HTTP/1."; nocase; depth:7; content:!" 200 OK"; nocase; distance:1; content:!" 206 Partial Content"; nocase; distance:1; classtype:attempted-admin; sid:9014691; rev:1; )
alert tcp any 80 -> any any (msg:"http reply 2"; flow:to_client,established; content:"HTTP/1."; content:" Expect"; nocase; within:20; distance:0; classtype:misc-attack; sid:9014252; rev:1;)
suricata v101/100 generate two alerts:
07/30/10-16:06:26.005780 [**] [1:9014691:1] http reply 1 [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 3] {6} 66.249.92.104:80 -> 192.168.70.5:56913
07/30/10-16:10:26.004807 [**] [1:9014691:1] http reply 1 [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 3] {6} 66.249.92.104:80 -> 192.168.70.5:56913
but if you disable second sig/sid (9014252), only one alert fire.
Why second alert not fire if I disable second sig/sid please?
Regards
Rmkml

Files

Download all files
Surf_Jacking_httpswillnotsaveyou.pdf (249 KB) Surf_Jacking_httpswillnotsaveyou.pdf rmkml rmkml, 08/06/2010 06:08 AM
0001-fix-for-bug-227.-For-negated-contents-that-have-been.patch (1.53 KB) 0001-fix-for-bug-227.-For-negated-contents-that-have-been.patch Anoop Saldanha, 10/28/2010 12:03 AM
Actions
Copy link

Also available in: Atom PDF