VRT Advisories


VRT Rules 2011-04-12

Sourcefire VRT Rules Update

Date: 2011-04-12

Synopsis:

The Sourcefire VRT is aware of vulnerabilities affecting products from Microsoft Inc. and Adobe Systems Inc.

Details:

Microsoft Security Advisory MS11-018:
Microsoft Internet Explorer contains programming errors that may allow a remote attacker to execute code on an affected system.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 3, SIDs 18646 and 18669 through 18671.

Microsoft Security Advisory MS11-019:
The Microsoft implementation of the Common Internet Filing System (CIFS) contains programming errors that may allow a remote attacker to execute code on an affected system.

Previously released rules will detect attacks targeting these vulnerabilities and are included in this release with updated reference information, and are identified with GID 3, SID 16631 and GID 1, SID 18462.

Microsoft Security Advisory MS11-020:
The Microsoft implementation of the Common Internet Filing System (CIFS), specifically the Server Message Block (SMB) portion, contains programming errors that may allow a remote attacker to execute code on an affected system.

A rule to detect attacks targeting this vulnerability is included in this release and is identified with GID 3, SID 18660.

Microsoft Security Advisory MS11-021:
Microsoft Excel contains programming errors that may allow a remote attacker to execute code on an affected system.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 3, SIDs 18630 through 18634, 18639 through 18641 and 18676.

Microsoft Security Advisory MS11-022:
Microsoft PowerPoint contains programming errors that may allow a remote attacker to execute code on an affected system.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 3, SIDs 18635 through 18637.

Microsoft Security Advisory MS11-023:
Microsoft Office contains programming errors that may allow a remote attacker to execute code on an affected system.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 3, SIDs 18638, 18647 and 18650.

Microsoft Security Advisory MS11-024:
The Microsoft Fax Cover Page Editor contains a programming error that may allow a remote attacker to execute code on an affected system.

A rule to detect attacks targeting this vulnerability is included in this release and is identified with GID 3, SID 18673.

Microsoft Security Advisory MS11-025:
The Microsoft Foundation Class Library (MFC) contains programming errors that may allow a remote attacker to execute code on an affected system via applications compiled using these libraries.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 3, SIDs 18619 through 18629.

Microsoft Security Advisory MS11-026:
The Microsoft implementation of Mime HTML (MHTML) contains programming errors that may allow a remote attacker to execute code on an affected system via a cross site scripting attack.

A previously released rule will detect attacks targeting this vulnerability and is included in this release with updated reference information, it is identified with GID 1, SID 18335.

Microsoft Security Advisory MS11-027:
Microsoft Internet Explorer when using ActiveX controls, contains programming errors that may allow a remote attacker to execute code on an affected system.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 3, SIDs 18668 and 18672.

Additionally, previously released rules will detect attacks targeting these vulnerabilities and are included in this release with updated reference information, they are identified with GID 1, SIDs 18241, 18242 and 18329.

Microsoft Security Advisory MS11-028:
The Microsoft .Net implementation contains a programming error that may allow a remote attacker to execute code on an affected system.

A rule to detect attacks targeting this vulnerability is included in this release and is identified with GID 3, SID 18624.

Microsoft Security Advisory MS11-029:
The Microsoft Graphics Device Interface (GDI) contains a programming error that may allow a remote attacker to execute code on an affected system.

A rule to detect attacks targeting this vulnerability is included in this release and is identified with GID 3, SID 18645.

Microsoft Security Advisory MS11-030:
The Microsoft implementation of the Domain Name System (DNS), specifically when handling the Link-local Multicast Name Resolution (LLMNR) protocol, contains a programming error that may allow a remote attacker to execute code on an affected system.

A rule to detect attacks targeting this vulnerability is included in this release and is identified with GID 3, SID 18655.

Microsoft Security Advisory MS11-032:
The Microsoft implementation for handling Open-Type fonts contains a programming error that may allow a remote attacker to execute code on an affected system.

A rule to detect attacks targeting this vulnerability is included in this release and is identified with GID 3, SID 18644.

Microsoft Security Advisory MS11-033:
The Microsoft Office Word Converter contains programming errors that may allow a remote attacker to execute code on an affected system.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 3, SIDs 18642 and 18643.

Microsoft Security Advisory MS11-034:
The Microsoft Windows Operating System contains programming errors that may allow an attacker to escalate privileges on an affected host.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 3, SIDs 18661 through 18667.

Adobe Security Advisory APSA11-02: Adobe Flash Player contains a programming error that may allow a remote attacker to execute code on an affected system.

A previously released rule will detect attacks targeting this vulnerability and is identified with GID 1, SID 18546.

Rule Pack Summary:

For a complete list of new and modified rules, click here.

Warning:

Sourcefire VRT rule packs often utilize enhancements made to Snort. Operators should upgrade to the latest revision or patch level for Snort to ensure these enhancements are available before using these rules.

About the VRT:

The Sourcefire VRT is a group of leading edge intrusion detection and prevention experts working to proactively discover, assess and respond to the latest trends in hacking activity, intrusion attempts and vulnerabilities. This team is also supported by the vast resources of the open source Snort community, making it the largest group dedicated to advances in the network security industry.

why subscribe? || download rules