[Oisf-devel] many FP on uricontent example

[Will Metcalf]

Have you tried the new master Victor just pushed?  This bug should be fixed.

Regards,

Will

On Tue, May 25, 2010 at 5:57 AM, rmkml <rmkml at free.fr> wrote:
> Hi,
> Maybe this pb is already known?
> With pcap joigned and this (old) sig:
>  alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS
> ping.asp access"; flow:to_server,established; uricontent:"/ping.asp";
> nocase; reference:nessus,10968; classtype:web-application-activity;
> sid:2667; rev:2;)
> I have many (8) alerts:
>  03/29/09-08:03:06.416199  [**] [1:2667:2] WEB-IIS ping.asp access [**]
> [Classification: access to a potentially vulnerable web application]
> [Priority: 3] {6} 10.50.1.118:2030 -> 194.245.144.33:80 [Xref =>
> http://cgi.nessus.org/plugins/dump.php3?id=10968]
>  ...
> If anyone confirm is not known, I fill a new ticket...
> Regards
> Rmkml
> _______________________________________________
> Oisf-devel mailing list
> Oisf-devel at openinfosecfoundation.org
> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel
>
>