I can't speak as someone who's experienced the issue, but presuming your customer's mysql version is vulnerable I would try and do that update as that version of MySQL is EXTREMELY old (Circa mid 2000s), although that could present other challenges. If the version is newer and not vulnerable, I'd open a support case so they can at least analyze and forward over to snort to fine tune the rule as its presumably a false positive. In that case I'd also be ok with whitelisting it.
... View more