VRT Advisories


VRT Rules 2005-07-08

Sourcefire VRT Certified Rules Update

Date: 2005-07-08

Synopsis:

The Sourcefire Vulnerability Research Team (VRT) has learned of a serious vulnerability affecting Internet Explorer.

Details:

Internet Explorer does not properly handle a COM object known as javaprxy.dll that is installed on hosts that run Microsoft Java Machine. When this COM object is invoked through a web page, the contents of the web page are copied to shared memory on the client host. When the web page contains a large amount of data, a buffer overflow can occur.

A Rule to detect attacks against this vulnerability is included in this rule pack and is identifed as sid 3814.

Rule Pack Summary:

For a complete list of new and modified rules, click here.

Warning:
Sourcefire VRT rule packs often utilize enhancements made to Snort. Operators should upgrade to the latest revision or patch level for Snort to ensure these enhancements are available before using these rules.

About the VRT:

The Sourcefire VRT is a group of leading edge intrusion detection and prevention experts working to proactively discover, assess and respond to the latest trends in hacking activity, intrusion attempts and vulnerabilities. This team is also supported by the vast resources of the open source Snort community, making it the largest group dedicated to advances in network security industry.