[Snort-sigs] Snort Community Rules Update

Sourcefire VRT research at ...435...
Fri May 5 11:17:03 EDT 2006

This message is to announce the availability of an update for the 
Sourcefire community rule set, which can be downloaded free of cost or 
registration from http://www.snort.org/pub-bin/downloads.cgi.

This update includes a new rule to detect Connect:Direct traffic, which 
may be a policy violation on certain networks; a heap overflow in 
RealPlayer; and the Nugache worm.

A list of modified rules and their SIDs follows.

Alex Kirk
Community Rules Maintainer
Sourcefire, Inc.

100000281 || COMMUNITY MISC Connect:Direct Server - Session Terminated 
Invalid Credentials
100000282 || COMMUNITY VIRUS Nugache connect
100000283 || COMMUNITY VIRUS Nugache data
100000284 || COMMUNITY WEB-CLIENT RealMedia invalid chunk size heap 
overflow attempt

More information about the Snort-sigs mailing list