-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Sourcefire VRT Certified Rules Update
Synopsis:
The Sourcefire VRT has continued research into the recently announced
vulnerabilities in Microsoft products. Additional detection has been
added in this rule pack for MS06-005 and MS06-004.
Details:
Microsoft Security Bulletin MS06-005
Microsoft Media Player plugin is subject to a buffer overflow condition
when handling embedded media in web pages. The plugin is used in
Mozilla browsers on hosts using the Microsoft Windows operating system.
A rule to detect attacks targeting this vulnerability is included in
this update and is identified as sid 5712.
Microsoft Security Bulletin MS06-004
Microsoft Internet Explorer does not properly process Windows Metafile
(WMF) images. An invalid size field in the header section of a WMF
image may allow an attacker to exploit an integer overflow condition
and execute code of their choosing on an affected host.
A rule to detect attacks targeting this vulnerability is included in
this update and is identified as sid 5713.
Updated rules:
5710 - WEB-CLIENT Windows Media Player Plugin for Non-IE browsers
buffer overflow attempt (web-client.rules)
New rules:
5708 - POLICY HTML File upload attempt (policy.rules)
5712 - WEB-CLIENT Windows Media Player invalid data offset bitmap heap
overflow attempt (web-client.rules)
5713 - WEB-CLIENT Windows Metafile invalid header size integer overflow
(web-client.rules)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (Darwin)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
iD8DBQFD9jGuMpm0ve0NhMcRApKMAJwPmfl5At5ClnbqNpXYcT2hxVV4VACfVXAB
gKsWMTR55VpbzvEcfbQOZBY=
=HCCY
-----END PGP SIGNATURE-----
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
