[Emerging-Sigs] observation on 2008041 and 2008042

[Jack Pepper]

Quoting Matt Jonkman <jonkman at jonkmans.com>:

> I made a flowbit modification to that yesterday. Are you running rev 2
> of 2008041?
>
> That will likely fix your issues there.
>

It does fix it.  The init phase (2008041) by itself is not an  
alertable event at all.  So yes, that's better.

-- 

Framework?  I don't need no stinking framework!

----------------------------------------------------------------
@fferent Security Labs:  Isolate/Insulate/Innovate  
http://www.afferentsecurity.com