SnortSnmp upgrade
Glenn Mansfield Keeni <[email protected]> Sat, 06 Dec 2003 09:47:17 +0900
| Newsgroups | gmane.comp.security.ids.snort.announce |
|---|---|
| Organization | Cyber Solutions Inc. |
| Message-ID | <[email protected]> |
SnortSnmp-folks,
The upgrades for the SnortSnmp output plugin corresponding
to Snort versions 2.0.[2-5] are available from
http://www.cysol.co.jp/contrib/snortsnmp/index.html
The changes from the previous version are
a. The code has been audited and cleaned for potential vulnerabilities.
[replaced sprintf by snprintf, strcpy by strncpy etc.]
b. A throttling mechanism for SNMP alerts has been added. [In case there
is a direct or indirect DoS attack on the IDS system itself. Only
MAXALERTSINONESEC alerts per second will be generated.
If MAXALERTSINONESEC == 0 this feature is turned off.
MAXALERTSINONESEC is defined in src/output-plugins/spo_SnmpTrap.c.
For more details refer to
http://www.cysol.co.jp/contrib/snortsnmp/changes.html
Cheers
Glenn
-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills. Sign up for IBM's
Free Linux Tutorials. Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click