Sourcefire VRT Rules Update

Date: 2007-10-16

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2.6.

The format of the file is:

sid - Message (rule group)

New rules:
12637 <-> WEB-CLIENT Kaspersky Online Scanner KAVWebScan.dll ActiveX clsid access (web-client.rules)
12638 <-> WEB-CLIENT Kaspersky Online Scanner KAVWebScan.dll ActiveX clsid unicode access (web-client.rules)
12639 <-> WEB-CLIENT Kaspersky Online Scanner KAVWebScan.dll ActiveX function call access (web-client.rules)
12640 <-> WEB-CLIENT Kaspersky Online Scanner KAVWebScan.dll ActiveX function call unicode access (web-client.rules)
12641 <-> POLICY Word for Mac 5 file download (policy.rules)
12643 <-> WEB-CLIENT URI External handler arbitrary command attempt (web-client.rules)
12644 <-> WEB-CLIENT PBEmail7 ActiveX clsid access (web-client.rules)
12645 <-> WEB-CLIENT PBEmail7 ActiveX clsid unicode access (web-client.rules)
12646 <-> WEB-CLIENT PBEmail7 ActiveX function call access (web-client.rules)
12647 <-> WEB-CLIENT PBEmail7 ActiveX function call unicode access (web-client.rules)
12648 <-> WEB-CLIENT DB Software Laboratory VImpX ActiveX clsid access (web-client.rules)
12649 <-> WEB-CLIENT DB Software Laboratory VImpX ActiveX clsid unicode access (web-client.rules)
12650 <-> WEB-CLIENT DB Software Laboratory VImpX ActiveX function call access (web-client.rules)
12651 <-> WEB-CLIENT DB Software Laboratory VImpX ActiveX function call unicode access (web-client.rules)

Updated rules:
12220 <-> EXPLOIT IBM Informix Dynamic Server long username (exploit.rules)
12417 <-> WEB-CLIENT Microsoft Visual FoxPro ActiveX clsid access (web-client.rules)
12418 <-> WEB-CLIENT Microsoft Visual FoxPro ActiveX clsid unicode access (web-client.rules)
12419 <-> WEB-CLIENT Microsoft Visual FoxPro ActiveX function call access (web-client.rules)
12420 <-> WEB-CLIENT Microsoft Visual FoxPro ActiveX function call unicode access (web-client.rules)
12618 <-> WEB-CLIENT Microsoft Visual Basic VBP file reference overflow attempt (web-client.rules)
12631 <-> EXPLOIT Microsoft Kodak Imaging malformed jpeg tables (exploit.rules)
12632 <-> EXPLOIT Microsoft Kodak Imaging malformed jpeg tables (exploit.rules)
12633 <-> EXPLOIT Microsoft Kodak Imaging malformed tiff (exploit.rules)
12634 <-> EXPLOIT Microsoft Kodak Imaging malformed tiff (exploit.rules)