Sourcefire VRT Rules Update

Date: 2009-06-09

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2.8.

The format of the file is:

sid - Message (rule group, priority)

New rules:
15518 <-> WEB-MISC Embedded Open Type Font download request (web-misc.rules, Low)
15543 <-> WEB-ACTIVEX Microsoft Communications Control v6 ActiveX clsid access (web-activex.rules, High)
15544 <-> WEB-ACTIVEX Microsoft Communications Control v6 ActiveX clsid unicode access (web-activex.rules, High)
15545 <-> WEB-ACTIVEX Microsoft Communications Control v6 ActiveX function call access (web-activex.rules, High)
15546 <-> WEB-ACTIVEX Microsoft Communications Control v6 ActiveX function call unicode access (web-activex.rules, High)
15547 <-> WEB-ACTIVEX eBay Picture Uploads control 1 ActiveX clsid access (web-activex.rules, High)
15548 <-> WEB-ACTIVEX eBay Picture Uploads control 1 ActiveX clsid unicode access (web-activex.rules, High)
15549 <-> WEB-ACTIVEX eBay Picture Uploads control 1 ActiveX function call access (web-activex.rules, High)
15550 <-> WEB-ACTIVEX eBay Picture Uploads control 1 ActiveX function call unicode access (web-activex.rules, High)
15551 <-> WEB-ACTIVEX eBay Picture Uploads control 2 ActiveX clsid access (web-activex.rules, High)
15552 <-> WEB-ACTIVEX eBay Picture Uploads control 2 ActiveX clsid unicode access (web-activex.rules, High)

Updated rules:
7070 <-> WEB-MISC encoded cross site scripting attempt (web-misc.rules, High)