[Snort-sigs] Sourcefire VRT Certified Rules Update

Sourcefire VRT Certified Rules Update

Synopsis:
The Sourcefire Vulnerability Research Team (VRT) has learned of a
serious vulnerability affecting Internet Explorer.

Details:
Internet Explorer does not properly handle a COM object known as
javaprxy.dll that is installed on hosts that run Microsoft Java
Machine. When this COM object is invoked through a web page, the
contents of the web page are copied to shared memory on the client
host. When the web page contains a large amount of data, a buffer
overflow can occur.

A Rule to detect attacks against this vulnerability is included in this
rule pack and is identified as sid 3814.

New rules:
3814 - WEB-CLIENT IE javaprxy.dll COM access (web-client.rules)

Updated rules:
3148 - WEB-CLIENT winhelp clsid attempt (web-client.rules)

Cheers,
Matthew Watchinski
Director, Vulnerability Research
Sourcefire, Inc.



-------------------------------------------------------
This SF.Net email is sponsored by the 'Do More With Dual!' webinar happening
July 14 at 8am PDT/11am EDT. We invite you to explore the latest in dual
core and dual graphics technology at this free one hour event hosted by HP,
AMD, and NVIDIA.  To register visit http://www.hp.com/go/dualwebinar
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs