-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Sourcefire VRT Certified Rules Update
Synopsis:
The Sourcefire VRT has learned of multiple vulnerabilities affecting
hosts using the Microsoft operating system and Veritas NetBackup.
Details:
Microsoft Security Bulletin MS06-013
Internet Explorer does not correctly handle ActiveX controls. Certain
COM objects can be called by Internet Explorer and executed as ActiveX
controls. When this is achieved, it may be possible for an attacker to
overwrite portions of memory and execute code of their choosing.
Rules to detect attacks against this vulnerability are included in this
rule pack and are identified as sids 6002 through 6009.
Veritas NetBackup
A vulnerability exists in the way that the Veritas NetBackup Server
validates input passed to various daemon processes. It may be possible
for an attacker to supply a large amount of data to the vnet daemon and
subsequently overflow a fixed length buffer and run code of their
choosing.
Rules to detect attacks against this vulnerability are included in this
rule pack and are identified as sids 6010 and 6011.
New rules:
5997 - WEB-MISC WinProxy overly long host header buffer overflow
attempt (web-misc.rules)
5998 - P2P Skype client login startup (p2p.rules)
5999 - P2P Skype client login (p2p.rules)
6000 - P2P Skype client login startup (p2p.rules)
6001 - P2P Skype client login (p2p.rules)
6002 - WEB-CLIENT Microsoft DT DDS Rectilinear GDD Layout ActiveX
Object Access (web-client.rules)
6003 - WEB-CLIENT Microsoft DT DDS Rectilinear GDD Route ActiveX Object
Access (web-client.rules)
6004 - WEB-CLIENT Microsoft DT DDS Circular Auto Layout Logic 2 ActiveX
Object Access (web-client.rules)
6005 - WEB-CLIENT Microsoft DT DDS Straight Line Routing Logic 2
ActiveX Object Access (web-client.rules)
6006 - WEB-CLIENT Microsoft DT Icon Control ActiveX Object Access
(web-client.rules)
6007 - WEB-CLIENT Microsoft DT DDS OrgChart GDD Layout ActiveX Object
Access (web-client.rules)
6008 - WEB-CLIENT Microsoft DT DDS OrgChart GDD Route ActiveX Object
Access (web-client.rules)
6009 - WEB-CLIENT RDS.Dataspace ActiveX Object Access
(web-client.rules)
6010 - EXPLOIT VERITAS NetBackup vnetd buffer overflow attempt
(exploit.rules)
6011 - EXPLOIT VERITAS NetBackup vnetd buffer overflow attempt
(exploit.rules)
Updated rules:
~ 159 - DELETED BACKDOOR NetMetro File List (deleted.rules)
2527 - SMTP STARTTLS attempt (smtp.rules)
3668 - MYSQL client authentication bypass attempt (mysql.rules)
5692 - P2P Skype client successful install (p2p.rules)
5693 - P2P Skype client start up get latest version attempt (p2p.rules)
5694 - P2P Skype client setup get newest version attempt (p2p.rules)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (Darwin)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
iD8DBQFEPYikMpm0ve0NhMcRAnywAJ0bUHaVhuWONw4Xv7CCLHocR6lNUgCeJ7M7
NcfpjACeVSNRRJ6bG8cQAH4=
=VpSh
-----END PGP SIGNATURE-----
-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
