[Firekeeper] Firekeeper 0.2.1.13 bug?

Doug Goss doug.goss at gmail.com
Fri Oct 5 16:05:55 PDT 2007


I got the same in 0.2.1.14 (but 0.2.1.13 was working OK for a couple of 
days till I upgraded to 0.2.1.14)
My initial reaction was to disable the additional remote files added in 
0.2.1.13.  This did not solve the problem.  I have no white list or 
black list entries so it is not them.

Rolled back to 0.2.1.13 and problem continues.

Compared archived default of 0.2.1.11 and commented out the following 
(not for any particular reason - just eliminating things by halves:

alert (msg:"Firekeeper 'pass' rule load attempt from remote location."; 
url_content:"http://malware.com.br/cgi/submit?action=list_fkeeper"; 
nocase; body_content:"pass"; body_re:"/^\s*pass/im"; fid:102;)
alert (msg:"Firekeeper 'drop' rule load attempt from remote location."; 
url_content:"http://malware.com.br/cgi/submit?action=list_fkeeper"; 
nocase; body_content:"drop"; body_re:"/^\s*drop/im"; fid:103;)

This allows Firefox to load and work but overwrites the changes I made 
when FF is next restarted - but it continues to work.  Weird.

Doug Goss



More information about the Firekeeper mailing list