-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Sourcefire VRT Certified Rules Update
Synopsis:
The Sourcefire VRT has learned of vulnerabilities affecting hosts using
the Microsoft Operating System and hosts using the Linux 2.6 kernel.
Details:
Microsoft Security Bulletin MS06-035
The mailslot service is used on hosts using the Microsoft Operating
System to handle messages between hosts on a domain.
An unchecked buffer in the mailslot server service may allow an
attacker to overflow a fixed length buffer and execute code of their
choosing on an affected host.
Rules to detect attempts to exploit this vulnerability are included in
this rule pack and are identified as sids 7035 through 7046.
Microsoft Security Bulletin MS06-037
An Excel file containing a chart object and another additional object
of any type with a large header length value, can be used to overflow a
fixed length buffer and execute code of the attackers choosing on an
affected host.
Rules to detect attempts to exploit this vulnerability are included in
this rule pack and are identified as sids 7047 and 7048.
Linux hosts using the Netfilter module may be subject to a Denial of
Service (DoS) condition when trying to process SCTP packets that do not
contain chunks.
A rule to detect attempts to exploit this vulnerability is included in
this rule pack and is identified as sid 7021.
New rules:
7020 - WEB-CLIENT isComponentInstalled function call access
(web-client.rules)
7021 - DOS linux kernel SCTP chunkless packet denial of service attempt
(dos.rules)
7022 - WEB-CLIENT windows explorer invalid url file overflow attempt
(web-client.rules)
7023 - WEB-CLIENT xls file download (web-client.rules)
7024 - WEB-CLIENT excel style handling overflow attempt
(web-client.rules)
7025 - WEB-CLIENT excel url unicode overflow attempt (web-client.rules)
7026 - WEB-CLIENT RDS.Dataspace ActiveX function call access
(web-client.rules)
7027 - WEB-IIS frontpage server extensions 2002 cross site scripting
attempt (web-iis.rules)
7028 - WEB-IIS frontpage server extensions 2002 cross site scripting
attempt (web-iis.rules)
7029 - WEB-IIS frontpage server extensions 2002 cross site scripting
attempt (web-iis.rules)
7030 - POLICY silc server response attempt (policy.rules)
7031 - POLICY silc client outbound connection attempt (policy.rules)
7032 - POLICY GoToMyPC startup (policy.rules)
7033 - POLICY GoToMyPC local service running (policy.rules)
7034 - POLICY GoToMyPC remote control attempt (policy.rules)
7035 - NETBIOS SMB Trans mailslot heap overflow attempt (netbios.rules)
7036 - NETBIOS SMB Trans unicode mailslot heap overflow attempt
(netbios.rules)
7037 - NETBIOS SMB-DS Trans mailslot heap overflow attempt
(netbios.rules)
7038 - NETBIOS SMB-DS Trans unicode mailslot heap overflow attempt
(netbios.rules)
7039 - NETBIOS-DG SMB Trans mailslot heap overflow attempt
(netbios.rules)
7040 - NETBIOS-DG SMB Trans unicode mailslot heap overflow attempt
(netbios.rules)
7041 - NETBIOS SMB Trans andx mailslot heap overflow attempt
(netbios.rules)
7042 - NETBIOS SMB Trans unicode andx mailslot heap overflow attempt
(netbios.rules)
7043 - NETBIOS SMB-DS Trans andx mailslot heap overflow attempt
(netbios.rules)
7044 - NETBIOS SMB-DS Trans unicode andx mailslot heap overflow attempt
(netbios.rules)
7045 - NETBIOS-DG SMB Trans andx mailslot heap overflow attempt
(netbios.rules)
7046 - NETBIOS-DG SMB Trans unicode andx mailslot heap overflow attempt
(netbios.rules)
7047 - WEB-CLIENT excel object record overflow attempt
(web-client.rules)
7048 - WEB-CLIENT excel object record overflow attempt
(web-client.rules)
Updated rules:
1801 - DELETED WEB-IIS .asp HTTP header buffer overflow attempt
(deleted.rules)
5704 - IMAP SELECT overflow attempt (imap.rules)
7002 - WEB-CLIENT excel url unicode overflow attempt (web-client.rules)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (Darwin)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
iD8DBQFEtrq5Mpm0ve0NhMcRAoXIAJ9PocMiPFie02lAfmu1XGTAkiyciACePUe7
POhGhhwXRVg6g9LKfkFb6co=
=mVJT
-----END PGP SIGNATURE-----
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
