Project

General

Profile

Actions

Bug #4286

open

FN occurs when using negated isdataat with http_cookie keyword

Added by Jason Taylor over 1 year ago. Updated about 2 months ago.

Status:
New
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:

Description

Given a sample of traffic such as:

GET /somestuff HTTP/1.1
Accept: */*
Cookie: id=234524dst35e
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0000; Windows NT 5.1; SV1)
Host: google.com

We would expect the following to work:

alert http $HOME_NET any -> $EXTERNAL_NET any (flow:established,to_server; content:"id="; depth:3; isdataat:!13,relative; http_cookie;)

However, the rule does not fire as expected in any of the 4.0.x, 4.1.x, 5.x versions I tested on.

If we switch the rule to use http.cookie, the rule works as expected.


Subtasks 1 (1 open0 closed)

Task #5483: create SV tests to demonstrate false negative behavior for negated isdataat with http_cookie keyword (bug 4286)NewOISF DevActions

Related issues 1 (1 open0 closed)

Related to Documentation #5484: userguide: explain content modifiers usage with regards to position usage in the ruleNewOISF DevActions
Actions #1

Updated by Philippe Antoine over 1 year ago

  • Is duplicate of Bug #2479: http_cookie negation fails if no cookie in traffic added
Actions #2

Updated by Victor Julien about 2 months ago

  • Is duplicate of deleted (Bug #2479: http_cookie negation fails if no cookie in traffic)
Actions #3

Updated by Juliana Fajardini Reichow about 2 months ago

  • Related to Task #5483: create SV tests to demonstrate false negative behavior for negated isdataat with http_cookie keyword (bug 4286) added
Actions #4

Updated by Juliana Fajardini Reichow about 2 months ago

  • Related to deleted (Task #5483: create SV tests to demonstrate false negative behavior for negated isdataat with http_cookie keyword (bug 4286))
Actions #5

Updated by Juliana Fajardini Reichow about 2 months ago

  • Subtask #5483 added
Actions #6

Updated by Juliana Fajardini Reichow about 2 months ago

  • Related to Documentation #5484: userguide: explain content modifiers usage with regards to position usage in the rule added
Actions

Also available in: Atom PDF