[Snort-sigs] Sourcefire VRT Certified Rules Update

Sourcefire VRT research at ...435...
Fri Jan 27 13:38:02 EST 2006


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Sourcefire VRT Certified Rules Update

Synopsis:
The Sourcefire VRT has added rules and improved detection capabilities
as a result of ongoing research into vulnerabilities and in response to
feedback regarding rule performance in certain situations.

Details:
The Sourcefire VRT has made extensive changes to the rule set in order
to improve detection and reduce false positive events.

The VRT have switched to a new build system for the VRT Certified Rules.
This new system uses all the same code the VRT uses to build the Sourcefire
product rule packs. The VRT have done a couple weeks worth of testing to
make sure this system works as expected, but with all systems there are
sometimes bugs. Please report any problems to bugs at ...95... or
research at ...435...

Additionally this new merge system has fixed an issue with rules not
being moved into deleted.rules correctly.  The changelog now shows that a
number of rules have now been correctly moved to deleted.rules. These rules
are no longer necessary for the operation of the system.

The VRT would also like to thank Jason Haar, Jeff Kell, and Russell Fulton
for their help in tracking down several false positive conditions.

Please continue to submit false positive reports, these detailed reports
with packet captures prove very useful in improving the quality of the
Snort
rule set.

New rules:
See snort.org for a complete changelog
http://www.snort.org/rules/docs/ruleset_changelogs/v24/changes-2006-01-27.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (Darwin)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFD2pKlMpm0ve0NhMcRAqglAJ4l/ldwQkHPMBv/MVuykgeQCJXCWgCgo21G
qtLM5LMPQeWzkaz3OEfLQsU=
=Zi9i
-----END PGP SIGNATURE-----




More information about the Snort-sigs mailing list