[Snort-sigs] Sourcefire VRT Certified Rules Update

Sourcefire VRT research at ...435...
Fri Sep 15 16:48:13 EDT 2006


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Sourcefire VRT Certified Rules Update

Synopsis:
The Sourcefire VRT has learned of multiple vulnerabilities affecting
hosts using the Microsoft Operating system.


Details:
Microsoft Security Bulletin MS06-054
Microsoft Publisher suffers from a programming error that may allow a
remote attacker to execute code of their choosing on an affected host.
The error is manifest when Publisher processes fonts embedded in a .pub
file.

A Rule to detect attacks against this vulnerability is included in this
rule pack and is identified as sid 8350.

Microsoft Security Bulletin MS06-053
Microsoft Indexing Service fails to correctly process user supplied
input which may allow a remote attacker to execute a cross site
scripting attack against a vulnerable server.

A Rule to detect attacks against this vulnerability is included in this
rule pack and is identified as sid 8349.

Microsoft Security Bulletin MS06-008
A buffer overflow condition exists in the Microsoft Web Client service
which may allow a remote attacker to execute code of their choosing on
an affected system. The flaw can be exploited by an authenticated or
guest user via RPC.

Rules to detect attacks against this vulnerability are included in this
rule pack and are identified as sids 8157 through 8348.

Microsoft Security Bulletin MS06-007
The Microsoft Windows Operating system suffers from a Denial of Service
(DoS) condition that is present when handling malformed IGMPv3 data.

A shared object rule to detect attacks against this vulnerability is
included in this rule pack and is identified as gid 3 sid 8092.

Microsoft Security Bulletin MS06-041
The Microsoft Windows DNS Client is vulnerable to a buffer overflow
condition when handling RDATA in server responses. A remote attacker
can take advantage of this to execute code of their choosing on an
affected system.

A new DNS dynamic preprocessor has been developed and released to
detect attacks against this vulnerability. This preprocessor has the
gid 131 and sids 1 through 3.  This is available by upgrading to snort
2.6.0.2 (http://www.snort.org/dl/)

For a complete list of new and modified rules:

http://www.snort.org/rules/docs/ruleset_changelogs/v26/changes-2006-09-15.html

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (Darwin)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFFCxGNMpm0ve0NhMcRApXgAJ9BbtGPO6T/m7jn3xZqXrsWWomVqgCfcPhu
adhKQvyi/kEpqJ7xLqP9eXI=
=DQ19
-----END PGP SIGNATURE-----




More information about the Snort-sigs mailing list