Snort mailing list archives
Sourcefire VRT Certified Snort Rules Update 2014-11-11
From: Research <research () sourcefire com>
Date: Tue, 11 Nov 2014 20:48:37 GMT
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Sourcefire VRT Certified Snort Rules Update Synopsis: The VRT is aware of vulnerabilities affecting products from Microsoft Corporation. Details: Microsoft Security Bulletin MS14-064: Coding deficiencies exist in Microsoft Windows OLE that may lead to remote code execution. A previously released rule will detect attacks targeting these vulnerabilities and has been updated with the appropriate reference information. It is included in this release and is identified with GID 1, SID 7070. New rules to detect attacks targeting these vulnerabilities are also included in this release and are identified with GID 1, SIDs 32470 through 32473. Microsoft Security Bulletin MS14-065: Microsoft Internet Explorer suffers from programming errors that may lead to remote code execution. Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 32424 through 32427, 32430 through 32431, 32436 through 32443, 32458 through 32461, 32476 through 32479, 32481 through 32485, 32491 through 32492, and 32495 through 32500. Microsoft Security Bulletin MS14-066: A coding deficiency exists in Microsoft Schannel that may lead to remote code execution. Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 32404 through 32423. Microsoft Security Bulletin MS14-067: A coding deficiency exists in Microsoft XML Core Services that may lead to remote code execution. Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 32501 through 32502. Microsoft Security Bulletin MS14-069: Microsoft Office suffers from programming errors that may lead to remote code execution. Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 32428 through 32429 and 32432 through 32435. Microsoft Security Bulletin MS14-070: Programming errors exist in Microsoft TCP/IP that may lead to an escalation of privilege. Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 32489 through 32490. Microsoft Security Bulletin MS14-071: A coding deficiency exists in the Microsoft Windows Audio Service that may lead to an escalation of privilege. Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 32518 through 32519. Microsoft Security Bulletin MS14-072: A coding deficiency exists in Microsoft .NET Framework that may lead to an escalation of privilege. Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 32474 through 32475. Microsoft Security Bulletin MS14-073: A coding deficiency exists in Microsoft SharePoint Foundation that may lead to an escalation of privilege. A previously released rule will detect attacks targeting this vulnerability and has been updated with the appropriate reference information. It is included in this release and is identified with GID 1, SID 7070. The VRT has also added and modified multiple rules in the blacklist, browser-ie, deleted, exploit-kit, file-office, file-other, malware-cnc, os-windows, policy-other, server-mail and server-webapp rule sets to provide coverage for emerging threats from these technologies. For a complete list of new and modified rules please see: https://www.snort.org/advisories -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFUYnYlQLjqI2QiHVMRAgeAAJ9wTGcJ4t+fw9yI+0kN8kO2nVPl8QCfde9J fNJ18oGfMI4R5sp5RHSnbz0= =FRF/ -----END PGP SIGNATURE----- ------------------------------------------------------------------------------ Comprehensive Server Monitoring with Site24x7. Monitor 10 servers for $9/Month. Get alerted through email, SMS, voice calls or mobile push notifications. Take corrective actions from your mobile device. http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- Sourcefire VRT Certified Snort Rules Update 2014-11-11 Research (Nov 11)