I'm glad that's getting fixed, that was one I just got a $#!^ load of falses
on. It was also catching the WfFtp server on routers...

> -----Original Message-----
> From: H D Moore [mailto:[EMAIL PROTECTED]
> Sent: Friday, February 28, 2003 11:36 AM
> To: [EMAIL PROTECTED]
> Cc: Renaud Deraison
> Subject: Re: Large number of false positives on WS_FTP SITE CPWD
> 
> 
> On Friday 28 February 2003 08:59 am, Hemsley, Trevor wrote:
> > I'm seeing a large number of false positives on the
> > DDI_ws_ftp-server-cpwd-bo.nasl test because it matches on any server
> > banner like
> >
> > 220 servername Microsoft FTP Service (Version 3.0).
> >
> > I've stared at that regexp for about 10 minutes and still can't make
> > sense of it :-(
> 
> Change the regex to the following, there was a missing parenthesis, 
> causing it to trigger on "WS_FTP 1.*|2.*" or ".*3.0".
> 
> ".*WS_FTP Server (((1|2)\..*)|(3\.((0(\..*){0,1})|(1\.1))))"
> 
> -HD
> 

Reply via email to