[Snort-sigs] Sourcefire VRT Certified Rules Update

Sourcefire VRT research at ...435...
Tue Jun 27 19:49:11 EDT 2006

Hash: SHA1

Sourcefire VRT Certified Rules Update

The Sourcefire VRT has continued research into a vulnerability
affecting the Microsoft Operating System Routing and Remote Access
Service (RRAS) and a vulnerability affecting Microsoft Excel.

Microsoft Security Bulletin MS06-025
Microsoft operating systems using Routing and Remote Access (RRAS) are
vulnerable to a memory corruption problem that may be exploited by
unauthenticated users. This may lead to code of the attackers choosing
being run on an affected host.

Rules to detect attacks against this vulnerability are included in this
rule pack and are identified as sids 6714 through 7001.

Microsoft Security Advisory (921365)
Microsoft Excel contains a programming error that can allow a remote
attacker to run code of their choosing on an affected host system via
the processing of a malformed .xls file. The issue is present in the
dynamic link library file HLINK.DLL which handles Universal Resource
Identifiers (URI) embedded in office documents.

A rule to detect attacks against this vulnerability is included in this
rule pack and is identified as sid 7002.

A full list of new and modified rules is available in the change-log
located on snort.org:
Version: GnuPG v1.4.2 (Darwin)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org


More information about the Snort-sigs mailing list