-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Sourcefire VRT Certified Rules Update
Synopsis:
The Sourcefire VRT is aware of vulnerabilities affecting Real Networks
Helix Server, IBM Lotus SameTime ActiveX control and an issue with ipv6
traffic handling on OpenBSD systems. This release also contains an
upgraded detection engine.
With the release of Snort 2.6.1.4 Sourcefire has added additional
detection for the OpenBSD IPv6 Fragmentation Overflow. Additionally
Snort 2.6.1.4 has addressed a number of potential security-related
issues as reported by customers, internal investigations,
and third-party code audits.
Details:
OpenBSD IPv6 Fragmentation Overflow (CVE-2007-1365) and OpenBSD ICMP6
Denial of Service (CVE-2007-0343):
The Snort 2.6.1.4 release includes detection capabilities for attacks
that attempt to exploit the IPv6 fragmentation overflow in OpenBSD-based
operating systems.
Important Information about IPv6 Fragmentation Overflow Detection
Detection of traffic that attempts to exploit the IPv6 fragmentation
overflow issue is enabled by default. If your Snort Sensors are deployed
inline on your network, the malicious traffic is dropped automatically.
In order to disable this functionality, the following line must be added
to snort.conf.
config ipv6_frag: drop_bad_ipv6_frag off
Events generated by the preprocessor are identified as GID 123 and SIDs
9 and 10.
Real Networks Helix Server (CVE-2006-6026):
The Real Networks Helix Server fails to properly check user-supplied
data to the application. This may allow a remote attacker to overflow a
fixed length buffer and execute code on a vulnerable host.
A rule to detect attacks targeting this vulnerability is included in
this release and is identified as SID 10407.
IBM Lotus SameTime (CVE-2007-1784):
IBM Lotus SameTime fails to properly process user-supplied input. This
may allow an attacker to load DLL files and execute code by supplying
suitable arguments to the loadLibrary function.
Rules to detect attacks targeting this vulnerability are included in
this release and are identified as SIDs 10412 through 10417.
For a complete list of new and modified rules please see:
http://www.snort.org/vrt/docs/ruleset_changelogs/changes-2007-04-03.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFGE9aEMpm0ve0NhMcRAicPAJ9I+3aqqHLoXsIqKqnnSdFSj1g0ygCghdfv
ML559PrymrzS8MLasvykrvk=
=5t82
-----END PGP SIGNATURE-----
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
