[Snort-sigs] Sourcefire VRT Certified Snort Rules Update

research at ...435... research at ...435...
Tue Jan 29 15:36:39 EST 2008


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Sourcefire VRT Certified Snort Rules Update

Synopsis:
The Sourcefire VRT is aware of vulnerabilities affecting the Cisco Unified Communications Manager and SAP MaxDB.

Details:
Cisco Unified Communications Manager Buffer Overflow (CVE-2008-0027):
A buffer overflow condition in the Certificate Trust List Provider service used by the Cisco Unified Communications Manager may allow a remote attacker to execute code on an affected system.

A rule to detect attacks targeting this vulnerability is included in this release and is identified as SID 13363.

SAP MaxDB Command Injection (CVE-2008-0244):
SAP MaxDB fails to correctly sanitize user-supplied input before passing the data to certain commands. A remote attacker may be able to inject commands to be executed on an affected system via the use of shell meta-characters.

A rule to detect attacks targeting this vulnerability is included in this release and is identified as SID 13356.

Other rules have been added to address the vulnerabilities described in CVE entries CVE-2007-5511, CVE-2007-4731, CVE-2007-6435 and CVE-2007-6335. Multiple rules have also been added to the spyware-put and web-client categories to provide further coverage for additional ActiveX vulnerabilities and spyware programs.

For a complete list of new and modified rules please see:

http://www.snort.org/vrt/docs/ruleset_changelogs/changes-2008-01-29.html

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Cygwin)

iD8DBQFHn2DRoFlcG+k7cPwRAglyAKDFvth2+986z4UlyLPzkFKFWQNxjgCfSBwe
pOOtzaZlfIWC8Y8Z3dDLC7Y=
=AT/x
-----END PGP SIGNATURE-----





More information about the Snort-sigs mailing list