[Snort-sigs] CVE-2012-5076 and CVE-2012-1723 Rules

lists at ...3397... lists at ...3397...
Mon Nov 26 10:00:35 EST 2012


On 11/25/2012 07:34 PM, Joel Esler wrote:> I'll take a look and see what we can
do to improve any coverage we are missing,
> blackhole, especially v2, is a pain.

Joel, on the ET side and based on my network analysis, I am seeing very good
methods for combating some of this.  I would like for us to work more on this,
any more news regarding a community focused ruleset without delay between
registered users and subscribers?

On 11/25/2012 04:26 AM, Snort Troubleshooting wrote:
> I went ahead and downloaded ET (open-source) rules and stuck them in there.
> Then I browsed to the blackhole website again, and Snort fired on two ET
> Rules, namely, sid:2015724, and sid:2015725.

You've just stumbled across some idiosyncratic differences between the VRT and
ET rulesets.  This has been discussed in the past but myself being a participant
in the ET ruleset I can say that as compared to VRT, ET/we are more focused on
the exploit kit and permutations of the exploit kits as a community and have
great coverage based on community input.

No flame war intended -- I think very highly of the VRT crew, but in a sea of
security issues there are differences between both rulesets and I always have
viewed them as complementary.  When ET PRO came out the gap between what ET
lacked was greatly reduced.  VRT has had some good exploit kit signatures as
well and when Joel and I were exchanging E-Mails and gearing up a community
around "VRT COMMUNITY" there was some great Blackhole V1 detection.

Wish everyone the best, and at no point am I trying to create a "me versus them"
theme.  We're all the good guys here, no point to piss on each others legs.
These are just my opinions after having been engaged in both communities for
some time.

Cheers,
Nathan





More information about the Snort-sigs mailing list