[Firekeeper] Firekeeper 0.2.1.13 bug?
Doug Goss
doug.goss at gmail.com
Fri Oct 5 16:05:55 PDT 2007
I got the same in 0.2.1.14 (but 0.2.1.13 was working OK for a couple of
days till I upgraded to 0.2.1.14)
My initial reaction was to disable the additional remote files added in
0.2.1.13. This did not solve the problem. I have no white list or
black list entries so it is not them.
Rolled back to 0.2.1.13 and problem continues.
Compared archived default of 0.2.1.11 and commented out the following
(not for any particular reason - just eliminating things by halves:
alert (msg:"Firekeeper 'pass' rule load attempt from remote location.";
url_content:"http://malware.com.br/cgi/submit?action=list_fkeeper";
nocase; body_content:"pass"; body_re:"/^\s*pass/im"; fid:102;)
alert (msg:"Firekeeper 'drop' rule load attempt from remote location.";
url_content:"http://malware.com.br/cgi/submit?action=list_fkeeper";
nocase; body_content:"drop"; body_re:"/^\s*drop/im"; fid:103;)
This allows Firefox to load and work but overwrites the changes I made
when FF is next restarted - but it continues to work. Weird.
Doug Goss
More information about the Firekeeper
mailing list