Sourcefire VRT Rules Update

Date: 2007-06-13

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2.1.

The format of the file is:

sid - Message (rule group)

New rules:
11838 <-> WEB-MISC Win32 API res buffer overflow attempt (web-misc.rules)
11839 <-> WEB-CLIENT TEC-IT TBarCode ActiveX clsid access (web-client.rules)
11840 <-> WEB-CLIENT TEC-IT TBarCode ActiveX clsid unicode access (web-client.rules)
11841 <-> WEB-CLIENT TEC-IT TBarCode ActiveX function call access (web-client.rules)
11842 <-> WEB-CLIENT TEC-IT TBarCode ActiveX function call unicode access (web-client.rules)
11939 <-> WEB-CLIENT Westbyte Internet Download Accelerator ActiveX clsid unicode access (web-client.rules)
11940 <-> WEB-CLIENT Westbyte Internet Download Accelerator ActiveX function call access (web-client.rules)
11941 <-> WEB-CLIENT Westbyte Internet Download Accelerator ActiveX function call unicode access (web-client.rules)
11942 <-> WEB-CLIENT Westbyte internet download accelerator ActiveX clsid access (web-client.rules)
11943 <-> WEB-CLIENT HP ModemUtil ActiveX clsid access (web-client.rules)
11944 <-> WEB-CLIENT HP ModemUtil ActiveX clsid unicode access (web-client.rules)

Updated rules:
10382 <-> NETBIOS DCERPC DIRECT v4 svcctl ChangeServiceConfig2A attempt (netbios.rules)
10384 <-> NETBIOS DCERPC DIRECT v4 svcctl ChangeServiceConfig2A little endian attempt (netbios.rules)
11826 <-> WEB-CLIENT Microsoft Voice Control ActiveX clsid access (web-client.rules)
11827 <-> WEB-CLIENT Microsoft Voice Control ActiveX clsid unicode access (web-client.rules)
11828 <-> WEB-CLIENT Microsoft Voice Control ActiveX function call access (web-client.rules)
11829 <-> WEB-CLIENT Microsoft Voice Control ActiveX function call unicode access (web-client.rules)
11830 <-> WEB-CLIENT Microsoft Direct Speech Recognition ActiveX clsid access (web-client.rules)
11831 <-> WEB-CLIENT Microsoft Direct Speech Recognition ActiveX clsid unicode access (web-client.rules)
11832 <-> WEB-CLIENT Microsoft Direct Speech Recognition ActiveX function call access (web-client.rules)
11833 <-> WEB-CLIENT Microsoft Direct Speech Recognition ActiveX function call unicode access (web-client.rules)