[Snort-sigs] Sourcefire VRT Certified Rules Update

Sourcefire VRT research at ...435...
Thu Mar 22 17:16:28 EDT 2007


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Sourcefire VRT Certified Rules Update

Synopsis:
The Sourcefire VRT is aware of vulnerabilities affecting Microsoft
Windows Server Service Controller, McAfee ePolicy Orchestrator and
Symantec SupportSoft ActiveX controls.


Details:
Microsoft Windows Server Service Controller:
The Server Service Controller is prone to a buffer overflow
vulnerability that may allow an attacker to take complete control of
the target host. Insufficient checks are made on user-supplied input to
calls made to the svcctl function. This may allow an attacker to
execute code of their choosing with system level privileges on an
affected host.

Rules to detect attacks targeting this vulnerability are included in
this release and are identified as SIDs 10217 through 10386.

McAfee ePolicy Orchestrator CVE-2007-1498:
McAfee ePolicy Orchestrator fails to correctly process user-supplied
input. It may be possible for a remote attacker to cause a buffer
overflow condition to occur and execute code on the host system.

Rules to detect attacks targeting this vulnerability are included in
this release and are identified as SIDs 10387 through 10389.

Symantec SupportSoft CVE-2006-6490:
Symantec SupportSoft ActiveX controls used in various products fail to
correctly process user-supplied input. It may be possible for a remote
attacker to cause a buffer overflow condition to occur and execute code
on the host system.

Rules to detect attacks targeting this vulnerability are included in
this release and are identified as SIDs 10214 through 10216.


For a complete list of new and modified rules please see:

http://www.snort.org/vrt/docs/ruleset_changelogs/changes-2007-03-22.htm
l
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGAvIsMpm0ve0NhMcRAqI3AJ4nlOmCGTs/hkgk8eYAQl24/stjFQCdGSbO
NTWTQWXt2ra8psYmkOYI9Ck=
=sGoP
-----END PGP SIGNATURE-----




More information about the Snort-sigs mailing list