[Snort-sigs] Sourcefire VRT Certified Rules Update

Sourcefire VRT research at ...435...
Wed Jan 10 14:40:26 EST 2007


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Sourcefire VRT Certified Rules Update

Synopsis:
The Sourcefire Vulnerability Research Team (VRT) has continued research
into vulnerabilities affecting Microsoft Outlook and Microsoft Internet
Explorer.


Details:
Microsoft Security Bulletin MS07-003:
Microsoft Outlook suffers from a programming error that may allow an
attacker to execute arbitrary code. This problem arises when Outlook
tries to process a malformed saved search file (.oss).

A rule to detect attacks targeting this vulnerability is included in
this release and is identified as SID 9847.

Microsoft Security Bulletin MS07-004:
Microsoft Internet Explorer contains a programming error that may lead
to an integer overflow condition. A remote attacker may be able to
execute code on an affected machine by hosting a web page which has
properties that could cause the overflow to occur.

Rules to detect attacks targeting this vulnerability are included in
this release and are identified as SIDs 9848 and 9849.


New rules:
9844 <-> WEB-CLIENT VLC Media Player udp URI format string attempt -
single packet (web-client.rules)
9845 <-> WEB-CLIENT M3U File Download Detected (web-client.rules)
9846 <-> WEB-CLIENT VLC Media Player udp URI format string attempt -
multipacket (web-client.rules)
9847 <-> WEB-CLIENT Outlook Saved Search download attempt
(web-client.rules)
9848 <-> WEB-CLIENT Vector Markup Language recolorinfo tag numfills
parameter buffer overflow attempt (web-client.rules)
9849 <-> WEB-CLIENT Vector Markup Language recolorinfo tag numcolors
parameter buffer overflow attempt (web-client.rules)

Updated rules:
8705 <-> SMTP YPOPS buffer overflow attempt (smtp.rules)
9671 <-> WEB-CLIENT RealPlayer AutoStream.AutoStream.1 ActiveX clsid
access (web-client.rules)
9672 <-> WEB-CLIENT RealPlayer AutoStream.AutoStream.1 ActiveX clsid
unicode access (web-client.rules)
9673 <-> WEB-CLIENT RealPlayer AutoStream.AutoStream.1 ActiveX function
call access (web-client.rules)
9793 <-> WEB-CLIENT YMMAPI.YMailAttach ActiveX clsid access
(web-client.rules)
9794 <-> WEB-CLIENT YMMAPI.YMailAttach ActiveX clsid unicode access
(web-client.rules)
9801 <-> WEB-CLIENT Windows Media Player Malformed MIDI File denial of
service attempt (web-client.rules)
9812 <-> WEB-CLIENT Yahoo Messenger YMailAttach ActiveX function call
access (web-client.rules)
9823 <-> WEB-CLIENT QuickTime RTSP URI overflow attempt
(web-client.rules)
9824 <-> WEB-CLIENT Rediff Bol Downloader ActiveX clsid access
(web-client.rules)
9825 <-> WEB-CLIENT Rediff Bol Downloader ActiveX clsid unicode access
(web-client.rules)
9826 <-> WEB-CLIENT Rediff Bol Downloader ActiveX function call access
(web-client.rules)
9840 <-> WEB-CLIENT QuickTime HREF Track Detected (web-client.rules)
9841 <-> SMTP Microsoft Outlook VEVENT overflow attempt (smtp.rules)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (Darwin)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFFpUEpMpm0ve0NhMcRAtzTAKCFWmWLpzbgeJFSuzgmyhxbNBCnegCfTjvn
07ee7y1UEKt/lLRBz8b1/aM=
=vcLW
-----END PGP SIGNATURE-----




More information about the Snort-sigs mailing list