The overflow is triggerd by a large number of <> bracket pairs. I think following custom signature will do the trick:
Current Signature: Engine STRING.TCP SIGID 20020
SigName: Sendmail exploit
___________________________________________________________________________
0 - Edit ALL Parameters
1 - AlarmInterval =
2 - AlarmThrottle = FireOnce
3 - ChokeThreshold =
4 - Direction = ToService
5 - FlipAddr =
6 - LimitSummary =
7 - MaxInspectLength =
8 - MinHits = 1
9 - MinMatchLength =
10 - MultipleHits =
11 * RegexString = [\<\>]{100}
12 - ResetAfterIdle = 15
13 - ServicePorts = 25
14 - SigComment =
15 - SigName = Sendmail exploit
16 - SigStringInfo =
17 - StripTelnetOptions =
18 - ThrottleInterval = 15
19 - WantFrag =
d - Delete a value
u - UNDO and continue
x - SAVE and continue
___________________________________________________________________________
Note it could also be triggerd by multiple single brackets <<< or >>>, but packetd was not working with (\<\>){100}
