Sourcefire VRT Certified Rules Update
Synopsis:
The Sourcefire Vulnerability Research Team (VRT) has learned of serious
vulnerabilities affecting MySQL and Ethereal. The VRT has also
completed work to normalize older rules to improve the detection
capabilities of the Snort engine.
Details:
There are two vulnerabilities associated with MySQL password
authentication. The first vulnerability may permit an unauthorized user
access to the server if the attacker knows an authorized username and
crafts a malicious client password hash. The second vulnerability may
cause a denial of service or buffer overflow if an attacker knows an
authorized username and crafts an overly long password hash.
Rules to detect attacks against this vulnerability are included in this
rule pack and are identifed as sids 3665 and 3672.
An error in the processing of tcp packets in a SIP protocol transaction
may lead to a Denial of Service (DoS) condition in Ethereal. The SIP
parsing routine does not properly check the length of data supplied to
a fixed length buffer in the processing of the SIP data.
Rules to detect attacks against this vulnerbility are included in this
rule pack and are identified as sids 3677 and 3678.
A complete list of modified and deleted rules is provided in a separate
file on snort.org.
http://www.snort.org/rules/docs/ruleset_changelogs/v23/changes-2005-05-31.html
New rules:
3639 - NETBIOS SMB Trans andx data displacement null pointer DOS attempt
(netbios.rules)
3640 - NETBIOS SMB Trans data displacement null pointer DOS attempt (netbios.rules)
3641 - NETBIOS SMB Trans unicode data displacement null pointer DOS attempt
(netbios.rules)
3642 - NETBIOS SMB Trans unicode andx data displacement null pointer DOS attempt
(netbios.rules)
3643 - NETBIOS SMB-DS Trans andx data displacement null pointer DOS attempt
(netbios.rules)
3644 - NETBIOS SMB-DS Trans data displacement null pointer DOS attempt
(netbios.rules)
3645 - NETBIOS SMB-DS Trans unicode data displacement null pointer DOS attempt
(netbios.rules)
3646 - NETBIOS SMB-DS Trans unicode andx data displacement null pointer DOS
attempt (netbios.rules)
3647 - NETBIOS-DG SMB Trans andx data displacement null pointer DOS attempt
(netbios.rules)
3648 - NETBIOS-DG SMB Trans data displacement null pointer DOS attempt
(netbios.rules)
3649 - NETBIOS-DG SMB Trans unicode data displacement null pointer DOS attempt
(netbios.rules)
3650 - NETBIOS-DG SMB Trans unicode andx data displacement null pointer DOS
attempt (netbios.rules)
3665 - MYSQL server greeting (mysql.rules)
3666 - MYSQL server greeting finished (mysql.rules)
3667 - MYSQL protocol 41 client authentication bypass attempt (mysql.rules)
3668 - MYSQL client authentication bypass attempt (mysql.rules)
3669 - MYSQL protocol 41 secure client overflow attempt (mysql.rules)
3670 - MYSQL secure client overflow attempt (mysql.rules)
3671 - MYSQL protocol 41 client overflow attempt (mysql.rules)
3672 - MYSQL client overflow attempt (mysql.rules)
3673 - MISC Microsoft SMS remote control client DoS overly long length attempt
(misc.rules)
3674 - WEB-CGI db4web_c directory traversal attempt (web-cgi.rules)
3675 - MISC IBM DB2 DTS empty format string dos attempt (misc.rules)
3676 - WEB-MISC newsscript.pl admin attempt (web-misc.rules)
3677 - EXPLOIT SIP UDP CSeq overflow attempt (exploit.rules)
3678 - EXPLOIT SIP TCP CSeq overflow attempt (exploit.rules)
3679 - WEB-CLIENT Firefox IFRAME src javascript code execution (web-client.rules)
-------------------------------------------------------
This SF.Net email is sponsored by Yahoo.
Introducing Yahoo! Search Developer Network - Create apps using Yahoo!
Search APIs Find out how you can build Yahoo! directly into your own
Applications - visit http://developer.yahoo.net/?fr=offad-ysdn-ostg-q22005
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
