VRT Advisories
« Previous 1 2 … 97 98 99 100 101 102 103 104 105 … 112 113 Next »
VRT Rules 2006-08-02
Sourcefire VRT Update
Date: 2006-08-02
Synopsis:
The Sourcefire VRT has added multiple rules to detect attempts to exploit vulnerabilities in the Microsoft DHCP Client Service, Microsoft Excel and Microsoft Word.
Details:
Microsoft Security Bulletin MS06-036 A buffer overflow condition in the Microsoft Windows DHCP client service may allow a remote attacker to execute code of their choosing on a target system. The overflow can be triggered when the client service attempts to process a malformed server response.
A module to detect attacks against this vulnerability is included in this rule pack and is identified as gid 3 sid 7196.
Microsoft Security Bulletin MS06-038 Multiple vulnerabilities exist in the Microsoft Office suite of programs that may allow a remote attacker to execute code of their choosing on an affected host. The vulnerabilities lie in the processing of malformed strings or properties in a document.
Rules to detect attacks against these vulnerabilites are included in this rule pack and are identified as sids 7197 through 7205.
Microsoft Security Bulletin MS06-035 Microsoft Windows SMB service is subject to a Denial of Service condition. While this is not related directly to the vulnerabilities outlined in MS06-035, after continuing research the Sourcefire VRT has determined that slight modifications to rules previously released will detect attempts to use attack vectors targeting this vulnerability.
The updated rules are included in this rule pack and are identified as sids 7035 through 7046.
Rule Pack Summary:
For a complete list of new and modified rules, click here.
Warning:
Sourcefire VRT rule packs often utilize enhancements made to Snort. Operators should upgrade to the latest revision or patch level for Snort to ensure these enhancements are available before using these rules.
About the VRT:
The Sourcefire VRT is a group of leading edge intrusion detection and prevention experts working to proactively discover, assess and respond to the latest trends in hacking activity, intrusion attempts and vulnerabilities. This team is also supported by the vast resources of the open source Snort community, making it the largest group dedicated to advances in the network security industry.
Posted by on Aug 02, 2006
VRT Rules 2006-07-28
Sourcefire VRT Update
Date: 2006-07-28
Synopsis:
The Sourcefire VRT has added multiple rules to detect the use of Spyware and potentially unwanted technology on a network.
Details:
As a result of continuing research in the field of Spyware and potentially unwanted technology, the Sourcefire VRT has added multiple rules to the Spyware and Backdoor rule sets.
Each rule is also accompanied by detailed documentation for each Spyware, trojan and potentially unwanted software to assist in determining the likelihood of infection and has relevant links to information regarding their removal.
This rule pack also contains a module for the detection of the Japanese peer-to-peer application "Winny".
The module is identified with gid 3 and sid 7019.
For instructions on how to use this module, refer to the Snort manual section regarding "Shared Object Rules".
Rule Pack Summary:
For a complete list of new and modified rules, click here.
Warning:
Sourcefire VRT rule packs often utilize enhancements made to Snort. Operators should upgrade to the latest revision or patch level for Snort to ensure these enhancements are available before using these rules.
About the VRT:
The Sourcefire VRT is a group of leading edge intrusion detection and prevention experts working to proactively discover, assess and respond to the latest trends in hacking activity, intrusion attempts and vulnerabilities. This team is also supported by the vast resources of the open source Snort community, making it the largest group dedicated to advances in the network security industry.
Posted by on Jul 28, 2006
VRT Rules 2006-07-20
Sourcefire VRT Advisory
Date: 2006-07-20
Synopsis:
The Sourcefire VRT has released a new version of the DocCheck tool.
Details:
The Sourcefire VRT has updated the DocCheck tool to fix a known problem that may arise under certain circumstances. The older version of the tool contains an error that may prevent the tool from operating correctly.
Warning:
Sourcefire VRT rule packs often utilize enhancements made to Snort. Operators should upgrade to the latest revision or patch level for Snort to ensure these enhancements are available before using these rules.
About the VRT:
The Sourcefire VRT is a group of leading edge intrusion detection and prevention experts working to proactively discover, assess and respond to the latest trends in hacking activity, intrusion attempts and vulnerabilities. This team is also supported by the vast resources of the open source Snort community, making it the largest group dedicated to advances in the network security industry.
DocCheck Tool Download:
About the VRT:
The Sourcefire VRT is a group of leading edge intrusion detection and prevention experts working to proactively discover, assess and respond to the latest trends in hacking activity, intrusion attempts and vulnerabilities. This team is also supported by the vast resources of the open source Snort community, making it the largest group dedicated to advances in the network security industry.
Posted by on Jul 20, 2006
VRT Rules 2006-07-18
Sourcefire VRT Advisory
Date: 2006-07-18
Synopsis:
The Sourcefire VRT has researched a vulnerability affecting Microsoft Powerpoint and has updated the DocCheck tool to process ppt files to determine the possible presence of exploit conditions.
Details:
Microsoft Security Advisory (922970) Microsoft Powerpoint suffers from a programming error that may allow an attacker to execute code of their choosing on an affected system by including that code in a specially crafted Powerpoint file.
The Sourcefire VRT has updated the DocCheck tool to examine Powerpoint files and report possible malformed files that could exploit this vulnerability.
DocCheck Tool Download:
About the VRT:
The Sourcefire VRT is a group of leading edge intrusion detection and prevention experts working to proactively discover, assess and respond to the latest trends in hacking activity, intrusion attempts and vulnerabilities. This team is also supported by the vast resources of the open source Snort community, making it the largest group dedicated to advances in the network security industry.
Posted by on Jul 18, 2006
VRT Rules 2006-07-13
Sourcefire VRT Update
Date: 2006-07-13
Synopsis:
The Sourcefire VRT has learned of vulnerabilities affecting hosts using the Microsoft Operating System and hosts using the Linux 2.6 kernel.
Details:
Microsoft Security Bulletin MS06-035 The mailslot service is used on hosts using the Microsoft Operating System to handle messages between hosts on a domain.
An unchecked buffer in the mailslot server service may allow an attacker to overflow a fixed length buffer and execute code of their choosing on an affected host.
Rules to detect attempts to exploit this vulnerability are included in this rule pack and are identified as sids 7035 through 7046.
Microsoft Security Bulletin MS06-037 An Excel file containing a chart object and another additional object of any type with a large header length value, can be used to overflow a fixed length buffer and execute code of the attackers choosing on an affected host.
Rules to detect attempts to exploit this vulnerability are included in this rule pack and are identified as sids 7047 and 7048.
Linux hosts using the Netfilter module may be subject to a Denial of Service (DoS) condition when trying to process SCTP packets that do not contain chunks.
A rule to detect attempts to exploit this vulnerability is included in this rule pack and is identified as sid 7021.
Rule Pack Summary:
For a complete list of new and modified rules, click here.
Warning:
Sourcefire VRT rule packs often utilize enhancements made to Snort. Operators should upgrade to the latest revision or patch level for Snort to ensure these enhancements are available before using these rules.
About the VRT:
The Sourcefire VRT is a group of leading edge intrusion detection and prevention experts working to proactively discover, assess and respond to the latest trends in hacking activity, intrusion attempts and vulnerabilities. This team is also supported by the vast resources of the open source Snort community, making it the largest group dedicated to advances in the network security industry.
Posted by on Jul 13, 2006
« Previous 1 2 … 97 98 99 100 101 102 103 104 105 … 112 113 Next »
