topic Re: Signature Update S161 Missing Signatures in Network Security

Signature Update S161 Missing Signatures

lbhoang — Sun, 10 Mar 2019 09:26:05 GMT

The following signatures are mentioned in the release notes but do not show up in VMS:

4703.0 MSSQL Resolution Service Stack Overflow STRING.TCP Info True

4704.0 MSSQL Resolution Service Stack Overflow STRING.TCP Info True

Re: Signature Update S161 Missing Signatures

craiwill — Mon, 02 May 2005 23:09:02 GMT

These are 5.x only signatures; they replace 4701 and 4702 which have been retired in 5.x. Thank you for bringing this to our attention, we are posting an updated version of the readme.

Re: Signature Update S161 Missing Signatures

jodr — Tue, 03 May 2005 08:15:45 GMT

What I have noticed already in former updates is that there is a difference in grouping of the new signatures in the CiscoWorks VMS/IDS MC and on the ids device itself(via IDM). For example, in S161, there is the new signature 3347 which is added to the attack signatures group under 'command execution' on the ids device, but in CW VMS I don't find this signature in the same category. For us this is however important to find this signature in the proper group in CW VMS, because we do additional modifications on those signatures.