Sourcefire VRT Certified Snort Rules Update 2014-11-11

[Research <research () sourcefire com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Sourcefire VRT Certified Snort Rules Update

Synopsis:
The VRT is aware of vulnerabilities affecting products from Microsoft
Corporation.

Details:
Microsoft Security Bulletin MS14-064:
Coding deficiencies exist in Microsoft Windows OLE that may lead to
remote code execution.

A previously released rule will detect attacks targeting these
vulnerabilities and has been updated with the appropriate reference
information. It is included in this release and is identified with GID
1, SID 7070.

New rules to detect attacks targeting these vulnerabilities are also
included in this release and are identified with GID 1, SIDs 32470
through 32473.

Microsoft Security Bulletin MS14-065:
Microsoft Internet Explorer suffers from programming errors that may
lead to remote code execution.

Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32424 through 32427,
32430 through 32431, 32436 through 32443, 32458 through 32461, 32476
through 32479, 32481 through 32485, 32491 through 32492, and 32495
through 32500.

Microsoft Security Bulletin MS14-066:
A coding deficiency exists in Microsoft Schannel that may lead to
remote code execution.

Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32404 through 32423.

Microsoft Security Bulletin MS14-067:
A coding deficiency exists in Microsoft XML Core Services that may lead
to remote code execution.

Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32501 through 32502.

Microsoft Security Bulletin MS14-069:
Microsoft Office suffers from programming errors that may lead to
remote code execution.

Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32428 through 32429
and 32432 through 32435.

Microsoft Security Bulletin MS14-070:
Programming errors exist in Microsoft TCP/IP that may lead to an
escalation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32489 through 32490.

Microsoft Security Bulletin MS14-071:
A coding deficiency exists in the Microsoft Windows Audio Service that
may lead to an escalation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32518 through 32519.

Microsoft Security Bulletin MS14-072:
A coding deficiency exists in Microsoft .NET Framework that may lead to
an escalation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32474 through 32475.

Microsoft Security Bulletin MS14-073:
A coding deficiency exists in Microsoft SharePoint Foundation that may
lead to an escalation of privilege.

A previously released rule will detect attacks targeting this
vulnerability and has been updated with the appropriate reference
information. It is included in this release and is identified with GID
1, SID 7070.


The VRT has also added and modified multiple rules in the blacklist,
browser-ie, deleted, exploit-kit, file-office, file-other, malware-cnc,
os-windows, policy-other, server-mail and server-webapp rule sets to
provide coverage for emerging threats from these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFUYnYlQLjqI2QiHVMRAgeAAJ9wTGcJ4t+fw9yI+0kN8kO2nVPl8QCfde9J
fNJ18oGfMI4R5sp5RHSnbz0=
=FRF/
-----END PGP SIGNATURE-----


------------------------------------------------------------------------------
Comprehensive Server Monitoring with Site24x7.
Monitor 10 servers for $9/Month.
Get alerted through email, SMS, voice calls or mobile push notifications.
Take corrective actions from your mobile device.
http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!