[Snort-sigs] Sourcefire VRT Certified Rules Update

Sourcefire VRT research at ...435...
Fri Sep 1 18:39:52 EDT 2006


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Sourcefire VRT Certified Rules Update

Synopsis:
The Sourcefire VRT has continued research into vulnerabilities
affecting Microsoft Internet Explorer and has also added multiple new
rules in the spyware-put category. The VRT has also improved the
performance of multiple rules and has improved reference information
for multiple rules.


Details:
Multiple vulnerabilities exist in the way that Microsoft Internet
Explorer handles ActiveX controls. It may be possible for an attacker
to execute code of their choosing on a system using Internet Explorer.

Rules to detect attacks against these vulnerabilities are included in
this rule pack and are identified as sids 7862 through 8058.

As a result of continuing research in the field of Spyware and
potentially unwanted technology, the Sourcefire VRT has added multiple
rules to the Spyware and Backdoor rule sets.

Each rule is also accompanied by detailed documentation for each
Trojan, Spyware and potentially unwanted software to assist in
determining the likelihood of infection and has relevant links to
information regarding their removal.

These rules are identified as sids 7794 through 7857.

A list of new and updated rules can be found here:

http://www.snort.org/rules/docs/ruleset_changelogs/v26/changes-2006-09-01.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (Darwin)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFE+La4Mpm0ve0NhMcRAsDoAJ9wG4VcTat92IJwoQ+yFwrOmAXnAgCdGjDu
YXm2woY1h3MDqlVsNooPl7c=
=9J/6
-----END PGP SIGNATURE-----




More information about the Snort-sigs mailing list