[Snort-users] snort http_inspect

Hello everyone,
I have a question about the use of the Snorts preprocess=
ors:
I've installed Snort on a Linux box and I've tried from outside to=
do a APACHE
CHUNKED ENCODE (Bugtraq ID: 5033, CVE:).
Snort records in=
the database only the http_inspect data, so : (http_inspect)
OVERSIZE =
CHUNK ENCODING
but it dsnt activate the rules, one of those I think=
:

web-misc.rules:alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PO=
RTS
(msg:"WEB-MISC Apache Chunked-Encoding worm attempt";
flow:to_serve=
r,established; content:"CCCCCCC\: AAAAAAAAAAAAAAAAAAA"; nocase;
classtyp=
e:web-application-attack; reference:bugtraq,4474;
reference:cve,CAN-2002=
-0079;reference:bugtraq,5033; reference:cve,CAN-2002-0392;
sid:1809; rev=
:2;)

web-misc.rules:alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP=
_PORTS
(msg:"WEB-MISC Chunked-Encoding transfer attempt"; flow:to_server=
,established;
content:"Transfer-Encoding\:"; nocase; content:"chunked"; =
nocase;
classtype:web-application-attack; reference:bugtraq,4474;
refer=
ence:cve,CAN-2002-0079; reference:bugtraq,5033;
reference:cve,CAN-2002-0=
392; sid:1807; rev:2;)

web-misc.rules:alert tcp $EXTERNAL_NET any -> $=
HTTP_SERVERS $HTTP_PORTS
(msg:"WEB-MISC apache chunked encoding memory c=
orruption exploit attempt";
flow:established,to_server; content:"|C0 50 =
52 89 E1 50 51 52 50 B8 3B 00 00 00
CD 80|"; reference:bugtraq,5033; ref=
erence:cve,CAN-2002-0392;
classtype:web-application-activity; sid:1808; =
rev:3;)


In fact I need the rules, that show me the correct ref ID (b=
ugtraq and so on) to
correlate the snort data with the VA.

Could some=
one help me? I have to deactivate the preprocessor?

Thanks ,

Matteo=





-------------------------------------------------------
This SF.Net email is sponsored by Sleepycat Software
Learn developer strategies Cisco, Motorola, Ericsson & Lucent use to
deliver higher performing products faster, at low TCO.
http://www.sleepycat.com/telcomwpreg...rom=osdnemail3
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users