From 834c36659e881aa9b140683151309e4229600b09 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Antti=20T=C3=B6nkyr=C3=A4?= Date: Tue, 19 May 2015 20:07:21 +0000 Subject: [PATCH] Allow colon in SSH version, at least some trojaned PuTTY clients have version like Putty-Local: Timestamp HH:MM:SS --- src/detect-ssh-software-version.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/detect-ssh-software-version.c b/src/detect-ssh-software-version.c index f2df5a5383..4197bfffff 100644 --- a/src/detect-ssh-software-version.c +++ b/src/detect-ssh-software-version.c @@ -61,7 +61,7 @@ /** * \brief Regex for parsing the softwareversion string */ -#define PARSE_REGEX "^\\s*\"?\\s*?([0-9a-zA-Z\\.\\-\\_\\+\\s+]+)\\s*\"?\\s*$" +#define PARSE_REGEX "^\\s*\"?\\s*?([0-9a-zA-Z\\:\\.\\-\\_\\+\\s+]+)\\s*\"?\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; -- 2.47.3