[Snort-sigs] Sourcefire VRT Certified Rules Update

Sourcefire VRT research at ...435...
Thu Mar 8 15:54:00 EST 2007


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Sourcefire VRT Certified Rules Update

Synopsis:
The Sourcefire VRT is aware of vulnerabilities affecting HP Mercury
Loadrunner, Shockwave, Trend Micro Officescan and Wordpress. This
release also includes more additions to the spyware-put and backdoor
rule sets.


Details:
HP Mercury LoadRunner CVE-2007-0446:
The HP Mercury LoadRunner agent suffers from a programming error that
may allow a remote attacker to cause a stack-based buffer overflow
condition to occur. This may lead to code execution of the attacker's
choosing.

A rule to detect attacks targeting this vulnerability is included in
this release and is identified as SID 10187.

Trend Micro OfficeScan CVE-2007-0325:
The Trend Micro OfficeScan Web-Deployment ActiveX control contains a
programming error that may allow remote attackers to execute code on an
affected host via a specially crafted web page.

Rules to detect attacks targeting this vulnerability are included in
this release and are identified as SIDs 10173 through 10175.

WordPress CVE-2007-1277:
The WordPress 2.1.1 source code was compromised by an attacker who then
introduced a backdoor into the application. This may allow other
attackers to execute commands or code of their choosing on an affected
server.

Rules to detect attacks targeting this vulnerability are included in
this release and are identified as SIDs 10196 and 10197.

Macromedia Shockwave Flash ActiveX control:
Macromedia Shockwave Flash contains a programming error that may allow
a remote attacker to execute code of their choosing on an affected host
using the ActiveX control.

Rules to detect attacks targeting this vulnerability are included in
this release and are identified as SIDs 10214 through 10216.

Also, the Sourcefire VRT has added multiple new rules to the backdoor
and spyware-put categories in this release.


For a complete list of new and modified rules please see:

http://www.snort.org/vrt/docs/ruleset_changelogs/changes-2007-03-08.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFF8HfnMpm0ve0NhMcRAli8AJ4vsSEpSNUNhfCyb2j2tBsdgZjNPwCdFn1w
H0xSTRQK+cBWBNDZ8Vq+S8U=
=xUez
-----END PGP SIGNATURE-----




More information about the Snort-sigs mailing list