Re: Emerging Threats ruleset error

[Joel Esler <jesler () sourcefire com>]

That's perfectly fine Shawn.  If it's Snort related, the conversation is
always welcome here.

On Wed, Jan 5, 2011 at 6:59 PM, Jefferson, Shawn <
Shawn.Jefferson () bcferries com> wrote:

>  Just got alerted (OSSEC!) that there is an error in an emerging threats
> rule:
>
> Jan  5 15:45:18 xxxxx02 snort[4414]: FATAL ERROR:
> /etc/snort/rules/emerging.rules(8587) What is this "o"(0x6F) doing in your
> binary buffer?  Valid hex values only please! (0x0 - 0xF) Position: 14
>
> alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX
> ImageShack Toolbar Remote Code Execution"; flow:established,to_client;
> content:"clsid"; nocase; content:"DC922B67-FF61-455E-9D79-959925B6695C";
> nocase; distance:0; content:"javascript|3a|document|2e|getElementById|28
> 27|"; content:"|2e|strategy"; distance:0; within:20;
> content:"javascript|3adocument.getElementById|28 27|"; distance:0;
> content:"|2e|target"; distance:0; within:20;
> pcre:"/<object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*DC922B67-FF61-455E-9D79-959925B6695C\s*}?\s*(.*)\>/si";
> classtype:attempted-user; reference:url,www.exploit-db.com/exploits/15601;
> sid:2012146; rev:4;)
>
> PS. Apologies for posting on the Snort list, but I'm not a member of any ET
> lists, and since it caused Snort to stop running, thought it would might be
> useful for others too.
>
> *-- *
> *Shawn Jefferson*
>
>
>
>
> ------------------------------------------------------------------------------
> Learn how Oracle Real Application Clusters (RAC) One Node allows customers
> to consolidate database storage, standardize their database environment,
> and,
> should the need arise, upgrade to a full multi-node Oracle RAC database
> without downtime or disruption
> http://p.sf.net/sfu/oracle-sfdevnl
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



-- 
Joel Esler
Skype:eslerjoel
http://blog.snort.org

------------------------------------------------------------------------------
Learn how Oracle Real Application Clusters (RAC) One Node allows customers
to consolidate database storage, standardize their database environment, and, 
should the need arise, upgrade to a full multi-node Oracle RAC database 
without downtime or disruption
http://p.sf.net/sfu/oracle-sfdevnl

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users