Re: Classtype accuracy?

Matthew Watchinski wrote:
> nnposter wrote:
> >I have recently run into several cases where the rule classtype seems 
> >incorrect. As an example, 2671 (WEB-CLIENT bitmap BitmapOffset integer 
> >overflow attempt) is classified as "attempted-admin", instead of
> >"attempted-user".
> >
> >Could somebody at Sourcefire be so kind and explain the current 
> >classification rules? Or is the example above just a mistake?
>
> Hum, guess so since the vulnerability executes as the user running IE, 
> we'll get that fixed.

Another suspicious rule is 2673.3 (WEB-CLIENT libpng tRNS overflow attempt)

Cheers,
nnposter


-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl