[Snort-sigs] Sourcefire VRT Certified Rules Update

Sourcefire VRT research at ...435...
Wed Oct 4 16:09:25 EDT 2006


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Sourcefire VRT Certified Rules Update

Synopsis:
The Sourcefire VRT has learned of vulnerabilities affecting OpenSSL
libraries and McAfee ePolicy Orchestrator and ProtectionPilot that may
allow remote code execution on affected systems.


Details:
OpenSSL Buffer Overflow CVE-2006-3738:
OpenSSL libraries are prone to a buffer overflow condition that may
allow a remote attacker to execute code of their choosing or cause a
Denial of Service (DoS) on an affected system.

This vulnerability affects software using these libraries and as such
the attack vector may be present in a number of services, such as web
and mail server daemons.

Rules to detect attacks targeting this vulnerability are included in
this rule pack and are identified as sids 8426 through 8440..

McAfee ePolicy Overflow CVE-2006-5156:
McAfee ePolicy Orchestrator and ProtectionPilot use a web server that
does not properly bounds check user supplied data. This may allow an
attacker to overflow a fixed length buffer on an affected system and
run code of their choosing.

A rule to detect attacks against this vulnerability is included in this
rule pack and is identified as sid 8441.


New rules:
8426 <-> Enabled  <-> WEB-MISC SSLv2 openssl get shared ciphers
overflow attempt (web-misc.rules)
8427 <-> Enabled  <-> WEB-MISC SSLv3 openssl get shared ciphers
overflow attempt (web-misc.rules)
8428 <-> Enabled  <-> WEB-MISC SSLv2 openssl get shared ciphers
overflow attempt (web-misc.rules)
8429 <-> Enabled  <-> POP3 SSLv2 openssl get shared ciphers overflow
attempt (pop3.rules)
8430 <-> Enabled  <-> POP3 SSLv3 openssl get shared ciphers overflow
attempt (pop3.rules)
8431 <-> Enabled  <-> POP3 SSLv2 openssl get shared ciphers overflow
attempt (pop3.rules)
8432 <-> Enabled  <-> SMTP SSLv2 openssl get shared ciphers overflow
attempt (smtp.rules)
8433 <-> Enabled  <-> SMTP SSLv2 openssl get shared ciphers overflow
attempt (smtp.rules)
8434 <-> Enabled  <-> SMTP SSLv3 openssl get shared ciphers overflow
attempt (smtp.rules)
8435 <-> Enabled  <-> SMTP SSLv3 openssl get shared ciphers overflow
attempt (smtp.rules)
8436 <-> Enabled  <-> SMTP SSLv2 openssl get shared ciphers overflow
attempt (smtp.rules)
8437 <-> Enabled  <-> SMTP SSLv2 openssl get shared ciphers overflow
attempt (smtp.rules)
8438 <-> Enabled  <-> IMAP SSLv2 openssl get shared ciphers overflow
attempt (imap.rules)
8439 <-> Enabled  <-> IMAP SSLv3 openssl get shared ciphers overflow
attempt (imap.rules)
8440 <-> Enabled  <-> IMAP SSLv2 openssl get shared ciphers overflow
attempt (imap.rules)
8441 <-> Enabled  <-> WEB-MISC McAfee header buffer overflow attempt
(web-misc.rules)
8442 <-> Enabled  <-> SMTP Mozilla regular expression heap corruption
attempt (smtp.rules)
8443 <-> Disabled <-> WEB-CLIENT Mozilla regular expression heap
corruption attempt (web-client.rules)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (Darwin)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFFJBT0Mpm0ve0NhMcRAtPGAJoDTNfBizPTn1ldPwBGYoVia21fGgCdFIxe
B+ucymDI5M9ot8O9j13TX2g=
=oG/V
-----END PGP SIGNATURE-----




More information about the Snort-sigs mailing list