-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Sourcefire VRT Certified Rules Update
Synopsis:
The Sourcefire Vulnerability Research Team (VRT) has continued research
into vulnerabilities affecting Microsoft Outlook and Microsoft Internet
Explorer.
Details:
Microsoft Security Bulletin MS07-003:
Microsoft Outlook suffers from a programming error that may allow an
attacker to execute arbitrary code. This problem arises when Outlook
tries to process a malformed saved search file (.oss).
A rule to detect attacks targeting this vulnerability is included in
this release and is identified as SID 9847.
Microsoft Security Bulletin MS07-004:
Microsoft Internet Explorer contains a programming error that may lead
to an integer overflow condition. A remote attacker may be able to
execute code on an affected machine by hosting a web page which has
properties that could cause the overflow to occur.
Rules to detect attacks targeting this vulnerability are included in
this release and are identified as SIDs 9848 and 9849.
New rules:
9844 <-> WEB-CLIENT VLC Media Player udp URI format string attempt -
single packet (web-client.rules)
9845 <-> WEB-CLIENT M3U File Download Detected (web-client.rules)
9846 <-> WEB-CLIENT VLC Media Player udp URI format string attempt -
multipacket (web-client.rules)
9847 <-> WEB-CLIENT Outlook Saved Search download attempt
(web-client.rules)
9848 <-> WEB-CLIENT Vector Markup Language recolorinfo tag numfills
parameter buffer overflow attempt (web-client.rules)
9849 <-> WEB-CLIENT Vector Markup Language recolorinfo tag numcolors
parameter buffer overflow attempt (web-client.rules)
Updated rules:
8705 <-> SMTP YPOPS buffer overflow attempt (smtp.rules)
9671 <-> WEB-CLIENT RealPlayer AutoStream.AutoStream.1 ActiveX clsid
access (web-client.rules)
9672 <-> WEB-CLIENT RealPlayer AutoStream.AutoStream.1 ActiveX clsid
unicode access (web-client.rules)
9673 <-> WEB-CLIENT RealPlayer AutoStream.AutoStream.1 ActiveX function
call access (web-client.rules)
9793 <-> WEB-CLIENT YMMAPI.YMailAttach ActiveX clsid access
(web-client.rules)
9794 <-> WEB-CLIENT YMMAPI.YMailAttach ActiveX clsid unicode access
(web-client.rules)
9801 <-> WEB-CLIENT Windows Media Player Malformed MIDI File denial of
service attempt (web-client.rules)
9812 <-> WEB-CLIENT Yahoo Messenger YMailAttach ActiveX function call
access (web-client.rules)
9823 <-> WEB-CLIENT QuickTime RTSP URI overflow attempt
(web-client.rules)
9824 <-> WEB-CLIENT Rediff Bol Downloader ActiveX clsid access
(web-client.rules)
9825 <-> WEB-CLIENT Rediff Bol Downloader ActiveX clsid unicode access
(web-client.rules)
9826 <-> WEB-CLIENT Rediff Bol Downloader ActiveX function call access
(web-client.rules)
9840 <-> WEB-CLIENT QuickTime HREF Track Detected (web-client.rules)
9841 <-> SMTP Microsoft Outlook VEVENT overflow attempt (smtp.rules)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (Darwin)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
iD8DBQFFpUEpMpm0ve0NhMcRAtzTAKCFWmWLpzbgeJFSuzgmyhxbNBCnegCfTjvn
07ee7y1UEKt/lLRBz8b1/aM=
=vcLW
-----END PGP SIGNATURE-----
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
