py-idstools icon indicating copy to clipboard operation
py-idstools copied to clipboard

Error when parsing Unicode in URL

Open Straevaras opened this issue 7 years ago • 0 comments

Specific example for current ET Trojan ruleset : https://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-trojan.rules

alert udp $HOME_NET any -> any 53 (msg:"ET TROJAN KHRAT DragonOK DNS Lookup (inter-ctrip .com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|inter-ctrip|03|com|00|"; nocase; distance:0; fast_pattern; metadata: former_category TROJAN; reference:url,blogs.forcepoint.com/security-labs/trojanized-adobe-installer-used-install-dragonok’s-new-custom-backdoor; classtype:trojan-activity; sid:2024108; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2017_03_29, performance_impact Low, updated_at 2017_03_29;)

Running gensidmsgmap creates exception

Traceback (most recent call last):
  File "/usr/bin/idstools-gensidmsgmap", line 12, in <module>
    sys.exit(main())
  File "/usr/lib/python2.7/site-packages/idstools/scripts/gensidmsgmap.py", line 131, in main
    print(idstools.rule.format_sidmsgmap(rules[rule_id]))
UnicodeEncodeError: 'ascii' codec can't encode character u'\u2019' in position 156: ordinal not in range(128)

For some reason a special character is used in the URL reference of the ET rule and gensidmsgmap can't handle it.

Straevaras avatar Dec 19 '17 15:12 Straevaras