[Snort-users] SID 1841

permalink · #1 (**permalink**) 12-29-2003

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

------_=_NextPart_001_01C3CE46.9E95B5F0
Content-Type: text/plain

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

When some users visit Netscape's site it is setting off an alert for
"WEB-CLIENT JavaScript URL host spoofing attempt". Specifically IPs
64.12.153.151 and 64.12.48.217. Is this just bad coding on Netscape's
part or is this rule not written correctly? I am using the most up to
date ruleset. Is anyone else seeing this?

Thanks,
Chris Romano

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com>

iQA/AwUBP/CINwvHK4/UMrUIEQKI7QCeNPxRD+KwWKcLovnCK441EzRnecsAoObT
XM6OGvPC7dQd49EwlYAtMdH7
=tV4p
-----END PGP SIGNATURE-----

------_=_NextPart_001_01C3CE46.9E95B5F0
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">
<META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version =
5.5.2653.12">
<TITLE>SID 1841</TITLE>
</HEAD>
<BODY>

-----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA1


When some users visit Netscape's site it is setting =
off an alert for
 "WEB-CLIENT JavaScript URL host spoofing =
attempt".  Specifically IPs
 64.12.153.151 and 64.12.48.217.  Is this just =
bad coding on Netscape's
 part or is this rule not written correctly?  I =
am using the most up to
 date ruleset.  Is anyone else seeing =
this?


Thanks,
 Chris Romano


-----BEGIN PGP SIGNATURE-----
 Version: PGPfreeware 6.5.8 for non-commercial use =
<<A HREF=3D"http://www.pgp.com" =
TARGET=3D"_blank">http://www.pgp.com</A>>


iQA/AwUBP/CINwvHK4/UMrUIEQKI7QCeNPxRD+KwWKcLovnCK441EzRnecsAoOb=
T
 XM6OGvPC7dQd49EwlYAtMdH7
 =3DtV4p
 -----END PGP SIGNATURE-----


</BODY>
</HTML>
------_=_NextPart_001_01C3CE46.9E95B5F0--

-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills. Sign up for IBM's
Free Linux Tutorials. Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode