-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Sourcefire VRT Certified Rules Update
Synopsis:
The Sourcefire VRT has learned of vulnerabilities affecting OpenSSL
libraries and McAfee ePolicy Orchestrator and ProtectionPilot that may
allow remote code execution on affected systems.
Details:
OpenSSL Buffer Overflow CVE-2006-3738:
OpenSSL libraries are prone to a buffer overflow condition that may
allow a remote attacker to execute code of their choosing or cause a
Denial of Service (DoS) on an affected system.
This vulnerability affects software using these libraries and as such
the attack vector may be present in a number of services, such as web
and mail server daemons.
Rules to detect attacks targeting this vulnerability are included in
this rule pack and are identified as sids 8426 through 8440..
McAfee ePolicy Overflow CVE-2006-5156:
McAfee ePolicy Orchestrator and ProtectionPilot use a web server that
does not properly bounds check user supplied data. This may allow an
attacker to overflow a fixed length buffer on an affected system and
run code of their choosing.
A rule to detect attacks against this vulnerability is included in this
rule pack and is identified as sid 8441.
New rules:
8426 <-> Enabled <-> WEB-MISC SSLv2 openssl get shared ciphers
overflow attempt (web-misc.rules)
8427 <-> Enabled <-> WEB-MISC SSLv3 openssl get shared ciphers
overflow attempt (web-misc.rules)
8428 <-> Enabled <-> WEB-MISC SSLv2 openssl get shared ciphers
overflow attempt (web-misc.rules)
8429 <-> Enabled <-> POP3 SSLv2 openssl get shared ciphers overflow
attempt (pop3.rules)
8430 <-> Enabled <-> POP3 SSLv3 openssl get shared ciphers overflow
attempt (pop3.rules)
8431 <-> Enabled <-> POP3 SSLv2 openssl get shared ciphers overflow
attempt (pop3.rules)
8432 <-> Enabled <-> SMTP SSLv2 openssl get shared ciphers overflow
attempt (smtp.rules)
8433 <-> Enabled <-> SMTP SSLv2 openssl get shared ciphers overflow
attempt (smtp.rules)
8434 <-> Enabled <-> SMTP SSLv3 openssl get shared ciphers overflow
attempt (smtp.rules)
8435 <-> Enabled <-> SMTP SSLv3 openssl get shared ciphers overflow
attempt (smtp.rules)
8436 <-> Enabled <-> SMTP SSLv2 openssl get shared ciphers overflow
attempt (smtp.rules)
8437 <-> Enabled <-> SMTP SSLv2 openssl get shared ciphers overflow
attempt (smtp.rules)
8438 <-> Enabled <-> IMAP SSLv2 openssl get shared ciphers overflow
attempt (imap.rules)
8439 <-> Enabled <-> IMAP SSLv3 openssl get shared ciphers overflow
attempt (imap.rules)
8440 <-> Enabled <-> IMAP SSLv2 openssl get shared ciphers overflow
attempt (imap.rules)
8441 <-> Enabled <-> WEB-MISC McAfee header buffer overflow attempt
(web-misc.rules)
8442 <-> Enabled <-> SMTP Mozilla regular expression heap corruption
attempt (smtp.rules)
8443 <-> Disabled <-> WEB-CLIENT Mozilla regular expression heap
corruption attempt (web-client.rules)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (Darwin)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
iD8DBQFFJBT0Mpm0ve0NhMcRAtPGAJoDTNfBizPTn1ldPwBGYoVia21fGgCdFIxe
B+ucymDI5M9ot8O9j13TX2g=
=oG/V
-----END PGP SIGNATURE-----
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys -- and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
