VRT Rules 2014-09-09
The VRT is aware of vulnerabilities affecting products from Microsoft Corporation.

Microsoft Security Bulletin MS14-052: Internet Explorer suffers from programming errors that may lead to remote code execution.

Previously released rules will detect attacks targeting these vulnerabilities and have been updated with the appropriate reference information. They are included in this release and are identified with GID 1, SIDs 29821 through 29822, and 30110 through 30113.

New rules to detect attacks targeting these vulnerabilities are also included in this release and are identified with GID 1, SIDs 31782 through 31791, 31794 through 31797, 31799 through 31802, and 31809 through 31812.

The VRT has added and modified multiple rules in the blacklist, browser-ie, exploit-kit, file-office, indicator-compromise and server-webapp rule sets to provide coverage for emerging threats from these technologies.

For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.

Change logs

2956

2014-09-09 16:03:11 UTC

Sourcefire VRT Rules Update

Date: 2014-09-09

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2956.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:31801 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer 11 InsertInputSubmit use after free attempt (browser-ie.rules)
 * 1:31800 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CTableCell Use After Free exploit attempt (browser-ie.rules)
 * 1:31788 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer justifying text with an incorrect type use after free attempt (browser-ie.rules)
 * 1:31787 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer style-image-url use after free attempt (browser-ie.rules)
 * 1:31807 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Nighthunter data exfiltration attempt (malware-cnc.rules)
 * 1:31793 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CGeneratedTreeNode use-after-free attempt (browser-ie.rules)
 * 1:31792 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CGeneratedTreeNode use-after-free attempt (browser-ie.rules)
 * 1:31790 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer CAttrArray use after free attempt (browser-ie.rules)
 * 1:31781 <-> ENABLED <-> BLACKLIST DNS request for known malware domain gefesosexwithjimmy.org (blacklist.rules)
 * 1:31782 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CHTMLEditor instance use after free attempt (browser-ie.rules)
 * 1:31789 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer justifying text with an incorrect type use after free attempt (browser-ie.rules)
 * 1:31785 <-> DISABLED <-> BROWSER-IE Internet Explorer 11 C1DLayout ruby element use-after-free attempt (browser-ie.rules)
 * 1:31783 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CHTMLEditor instance use after free attempt (browser-ie.rules)
 * 1:31784 <-> DISABLED <-> BROWSER-IE Internet Explorer 11 C1DLayout ruby element use-after-free attempt (browser-ie.rules)
 * 1:31812 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer CHtmlLayout use after free attempt (browser-ie.rules)
 * 1:31797 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer 11 CTreeNode use after free (browser-ie.rules)
 * 1:31795 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer access violation attempt (browser-ie.rules)
 * 1:31794 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer access violation attempt (browser-ie.rules)
 * 1:31796 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer 11 CTreeNode use after free (browser-ie.rules)
 * 1:31799 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CTableCell Use After Free exploit attempt (browser-ie.rules)
 * 1:31798 <-> DISABLED <-> SERVER-WEBAPP HP Network Virtualization storedNtxFile directory traversal attempt (server-webapp.rules)
 * 1:31802 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer 11 InsertInputSubmit use after free attempt (browser-ie.rules)
 * 1:31791 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer CAttrArray use after free attempt (browser-ie.rules)
 * 1:31803 <-> ENABLED <-> BLACKLIST DNS request for known malware domain imaps.qki6.com - Win.Trojan.Dizk (blacklist.rules)
 * 1:31811 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer CHtmlLayout use after free attempt (browser-ie.rules)
 * 1:31804 <-> ENABLED <-> BLACKLIST DNS request for known malware domain static.jg7.org - Win.Trojan.Dizk (blacklist.rules)
 * 1:31808 <-> ENABLED <-> MALWARE-CNC Linux.Trojan.IptabLex outbound connection attempt (malware-cnc.rules)
 * 1:31805 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Dizk variant outbound connection (malware-cnc.rules)
 * 1:31806 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Nighthunter data exfiltration attempt (malware-cnc.rules)
 * 1:31786 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer style-image-url use after free attempt (browser-ie.rules)
 * 1:31809 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer integer overflow exploit attempt (browser-ie.rules)
 * 1:31810 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer integer overflow exploit attempt (browser-ie.rules)

Modified Rules:


 * 1:29105 <-> DISABLED <-> SERVER-WEBAPP ManageEngine DesktopCentral agentLogUploader servlet directory traversal attempt (server-webapp.rules)
 * 1:29821 <-> ENABLED <-> INDICATOR-COMPROMISE Windows Internet Explorer EMET check and garbage collection (indicator-compromise.rules)
 * 1:29822 <-> ENABLED <-> INDICATOR-COMPROMISE Windows Internet Explorer EMET check and garbage collection (indicator-compromise.rules)
 * 1:29999 <-> ENABLED <-> BLACKLIST USER-AGENT known Malicious user agent - MSIE 9.0 in version 10 format (blacklist.rules)
 * 1:30110 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CMarkup object use after free attempt (browser-ie.rules)
 * 1:30111 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CMarkup object use after free attempt (browser-ie.rules)
 * 1:30112 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CMarkup object use after free attempt (browser-ie.rules)
 * 1:30113 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CMarkup object use after free attempt (browser-ie.rules)
 * 1:31586 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Backoff initial outbound connection (malware-cnc.rules)
 * 1:31734 <-> ENABLED <-> EXPLOIT-KIT Nuclear exploit kit landing page detection (exploit-kit.rules)
 * 1:31751 <-> DISABLED <-> FILE-OFFICE Microsoft Outlook mailto injection attempt (file-office.rules)
 * 1:31752 <-> DISABLED <-> FILE-OFFICE Microsoft Outlook mailto injection attempt (file-office.rules)

2961

2014-09-09 16:03:11 UTC

Sourcefire VRT Rules Update

Date: 2014-09-09

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2961.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:31793 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CGeneratedTreeNode use-after-free attempt (browser-ie.rules)
 * 1:31792 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CGeneratedTreeNode use-after-free attempt (browser-ie.rules)
 * 1:31790 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer CAttrArray use after free attempt (browser-ie.rules)
 * 1:31787 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer style-image-url use after free attempt (browser-ie.rules)
 * 1:31788 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer justifying text with an incorrect type use after free attempt (browser-ie.rules)
 * 1:31789 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer justifying text with an incorrect type use after free attempt (browser-ie.rules)
 * 1:31794 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer access violation attempt (browser-ie.rules)
 * 1:31795 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer access violation attempt (browser-ie.rules)
 * 1:31796 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer 11 CTreeNode use after free (browser-ie.rules)
 * 1:31797 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer 11 CTreeNode use after free (browser-ie.rules)
 * 1:31798 <-> DISABLED <-> SERVER-WEBAPP HP Network Virtualization storedNtxFile directory traversal attempt (server-webapp.rules)
 * 1:31800 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CTableCell Use After Free exploit attempt (browser-ie.rules)
 * 1:31799 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CTableCell Use After Free exploit attempt (browser-ie.rules)
 * 1:31785 <-> DISABLED <-> BROWSER-IE Internet Explorer 11 C1DLayout ruby element use-after-free attempt (browser-ie.rules)
 * 1:31801 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer 11 InsertInputSubmit use after free attempt (browser-ie.rules)
 * 1:31784 <-> DISABLED <-> BROWSER-IE Internet Explorer 11 C1DLayout ruby element use-after-free attempt (browser-ie.rules)
 * 1:31802 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer 11 InsertInputSubmit use after free attempt (browser-ie.rules)
 * 1:31783 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CHTMLEditor instance use after free attempt (browser-ie.rules)
 * 1:31803 <-> ENABLED <-> BLACKLIST DNS request for known malware domain imaps.qki6.com - Win.Trojan.Dizk (blacklist.rules)
 * 1:31782 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CHTMLEditor instance use after free attempt (browser-ie.rules)
 * 1:31805 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Dizk variant outbound connection (malware-cnc.rules)
 * 1:31781 <-> ENABLED <-> BLACKLIST DNS request for known malware domain gefesosexwithjimmy.org (blacklist.rules)
 * 1:31804 <-> ENABLED <-> BLACKLIST DNS request for known malware domain static.jg7.org - Win.Trojan.Dizk (blacklist.rules)
 * 1:31806 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Nighthunter data exfiltration attempt (malware-cnc.rules)
 * 1:31807 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Nighthunter data exfiltration attempt (malware-cnc.rules)
 * 1:31808 <-> ENABLED <-> MALWARE-CNC Linux.Trojan.IptabLex outbound connection attempt (malware-cnc.rules)
 * 1:31791 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer CAttrArray use after free attempt (browser-ie.rules)
 * 1:31812 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer CHtmlLayout use after free attempt (browser-ie.rules)
 * 1:31811 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer CHtmlLayout use after free attempt (browser-ie.rules)
 * 1:31786 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer style-image-url use after free attempt (browser-ie.rules)
 * 1:31810 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer integer overflow exploit attempt (browser-ie.rules)
 * 1:31809 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer integer overflow exploit attempt (browser-ie.rules)

Modified Rules:


 * 1:29105 <-> DISABLED <-> SERVER-WEBAPP ManageEngine DesktopCentral agentLogUploader servlet directory traversal attempt (server-webapp.rules)
 * 1:29821 <-> ENABLED <-> INDICATOR-COMPROMISE Windows Internet Explorer EMET check and garbage collection (indicator-compromise.rules)
 * 1:29822 <-> ENABLED <-> INDICATOR-COMPROMISE Windows Internet Explorer EMET check and garbage collection (indicator-compromise.rules)
 * 1:29999 <-> ENABLED <-> BLACKLIST USER-AGENT known Malicious user agent - MSIE 9.0 in version 10 format (blacklist.rules)
 * 1:30110 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CMarkup object use after free attempt (browser-ie.rules)
 * 1:30111 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CMarkup object use after free attempt (browser-ie.rules)
 * 1:30112 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CMarkup object use after free attempt (browser-ie.rules)
 * 1:30113 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CMarkup object use after free attempt (browser-ie.rules)
 * 1:31586 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Backoff initial outbound connection (malware-cnc.rules)
 * 1:31734 <-> ENABLED <-> EXPLOIT-KIT Nuclear exploit kit landing page detection (exploit-kit.rules)
 * 1:31751 <-> DISABLED <-> FILE-OFFICE Microsoft Outlook mailto injection attempt (file-office.rules)
 * 1:31752 <-> DISABLED <-> FILE-OFFICE Microsoft Outlook mailto injection attempt (file-office.rules)

2962

2014-09-09 16:03:11 UTC

Sourcefire VRT Rules Update

Date: 2014-09-09

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2962.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:31812 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer CHtmlLayout use after free attempt (browser-ie.rules)
 * 1:31811 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer CHtmlLayout use after free attempt (browser-ie.rules)
 * 1:31810 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer integer overflow exploit attempt (browser-ie.rules)
 * 1:31809 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer integer overflow exploit attempt (browser-ie.rules)
 * 1:31808 <-> ENABLED <-> MALWARE-CNC Linux.Trojan.IptabLex outbound connection attempt (malware-cnc.rules)
 * 1:31807 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Nighthunter data exfiltration attempt (malware-cnc.rules)
 * 1:31806 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Nighthunter data exfiltration attempt (malware-cnc.rules)
 * 1:31805 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Dizk variant outbound connection (malware-cnc.rules)
 * 1:31804 <-> ENABLED <-> BLACKLIST DNS request for known malware domain static.jg7.org - Win.Trojan.Dizk (blacklist.rules)
 * 1:31803 <-> ENABLED <-> BLACKLIST DNS request for known malware domain imaps.qki6.com - Win.Trojan.Dizk (blacklist.rules)
 * 1:31802 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer 11 InsertInputSubmit use after free attempt (browser-ie.rules)
 * 1:31801 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer 11 InsertInputSubmit use after free attempt (browser-ie.rules)
 * 1:31800 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CTableCell Use After Free exploit attempt (browser-ie.rules)
 * 1:31799 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CTableCell Use After Free exploit attempt (browser-ie.rules)
 * 1:31798 <-> DISABLED <-> SERVER-WEBAPP HP Network Virtualization storedNtxFile directory traversal attempt (server-webapp.rules)
 * 1:31797 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer 11 CTreeNode use after free (browser-ie.rules)
 * 1:31796 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer 11 CTreeNode use after free (browser-ie.rules)
 * 1:31795 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer access violation attempt (browser-ie.rules)
 * 1:31794 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer access violation attempt (browser-ie.rules)
 * 1:31793 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CGeneratedTreeNode use-after-free attempt (browser-ie.rules)
 * 1:31792 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CGeneratedTreeNode use-after-free attempt (browser-ie.rules)
 * 1:31791 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer CAttrArray use after free attempt (browser-ie.rules)
 * 1:31790 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer CAttrArray use after free attempt (browser-ie.rules)
 * 1:31789 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer justifying text with an incorrect type use after free attempt (browser-ie.rules)
 * 1:31788 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer justifying text with an incorrect type use after free attempt (browser-ie.rules)
 * 1:31787 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer style-image-url use after free attempt (browser-ie.rules)
 * 1:31786 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer style-image-url use after free attempt (browser-ie.rules)
 * 1:31785 <-> DISABLED <-> BROWSER-IE Internet Explorer 11 C1DLayout ruby element use-after-free attempt (browser-ie.rules)
 * 1:31784 <-> DISABLED <-> BROWSER-IE Internet Explorer 11 C1DLayout ruby element use-after-free attempt (browser-ie.rules)
 * 1:31783 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CHTMLEditor instance use after free attempt (browser-ie.rules)
 * 1:31782 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CHTMLEditor instance use after free attempt (browser-ie.rules)
 * 1:31781 <-> ENABLED <-> BLACKLIST DNS request for known malware domain gefesosexwithjimmy.org (blacklist.rules)

Modified Rules:


 * 1:29105 <-> DISABLED <-> SERVER-WEBAPP ManageEngine DesktopCentral agentLogUploader servlet directory traversal attempt (server-webapp.rules)
 * 1:29821 <-> ENABLED <-> INDICATOR-COMPROMISE Windows Internet Explorer EMET check and garbage collection (indicator-compromise.rules)
 * 1:29822 <-> ENABLED <-> INDICATOR-COMPROMISE Windows Internet Explorer EMET check and garbage collection (indicator-compromise.rules)
 * 1:29999 <-> ENABLED <-> BLACKLIST USER-AGENT known Malicious user agent - MSIE 9.0 in version 10 format (blacklist.rules)
 * 1:30110 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CMarkup object use after free attempt (browser-ie.rules)
 * 1:30111 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CMarkup object use after free attempt (browser-ie.rules)
 * 1:30112 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CMarkup object use after free attempt (browser-ie.rules)
 * 1:30113 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CMarkup object use after free attempt (browser-ie.rules)
 * 1:31586 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Backoff initial outbound connection (malware-cnc.rules)
 * 1:31734 <-> ENABLED <-> EXPLOIT-KIT Nuclear exploit kit landing page detection (exploit-kit.rules)
 * 1:31751 <-> DISABLED <-> FILE-OFFICE Microsoft Outlook mailto injection attempt (file-office.rules)
 * 1:31752 <-> DISABLED <-> FILE-OFFICE Microsoft Outlook mailto injection attempt (file-office.rules)