Sourcefire VRT Rules Update
Date: 2010-05-04
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2.8_6_0.
The format of the file is:
sid - Message (rule group, priority)
New rules: 16565 <-> WEB-ACTIVEX Ultra Shareware Office ActiveX clsid access (web-activex.rules, High) 16566 <-> WEB-ACTIVEX Tumbleweed SecureTransport ActiveX clsid access (web-activex.rules, High) 16567 <-> WEB-ACTIVEX Tumbleweed SecureTransport ActiveX clsid unicode access (web-activex.rules, High) 16568 <-> WEB-ACTIVEX Altnet Download Manager ADM4 ActiveX clsid access (web-activex.rules, High) 16569 <-> WEB-ACTIVEX EnjoySAP kweditcontrol ActiveX clsid access (web-activex.rules, High) 16570 <-> WEB-ACTIVEX EnjoySAP kweditcontrol ActiveX clsid unicode access (web-activex.rules, High) 16571 <-> WEB-ACTIVEX EnjoySAP kweditcontrol ActiveX function call access (web-activex.rules, High) 16572 <-> WEB-ACTIVEX EnjoySAP kweditcontrol ActiveX function call unicode access (web-activex.rules, High) 16573 <-> WEB-ACTIVEX obfuscated ActiveX object instantiation via unescape (web-activex.rules, High) 16574 <-> WEB-ACTIVEX obfuscated ActiveX object instantiation via fromCharCode (web-activex.rules, High) 16575 <-> SPECIFIC-THREATS RKD Software BarCode ActiveX buffer overflow attempt (specific-threats.rules, High) 16576 <-> EXPLOIT RealNetworks Helix AgentX receive_agentx stack buffer overflow attempt (exploit.rules, High) 16578 <-> EXPLOIT Microsoft Windows Media Encoder 9 ActiveX buffer overflow attempt (exploit.rules, High) 16579 <-> CHAT mIRC IRC URL buffer overflow attempt (chat.rules, High) 16580 <-> SPECIFIC-THREATS NCTAudioFile2 ActiveX clsid access via object tag (specific-threats.rules, High) 16581 <-> SPECIFIC-THREATS Persits Software XUpload ActiveX clsid unsafe function access attempt (specific-threats.rules, High) 16582 <-> WEB-CLIENT Un4seen Developments XMPlay crafted ASX file buffer overflow attempt (web-client.rules, High) 16583 <-> WEB-CLIENT Un4seen Developments XMPlay crafted ASX file buffer overflow attempt (web-client.rules, High) 16584 <-> WEB-CLIENT Java Web Start arbitrary command execution attempt - Internet Explorer (web-client.rules, High) 16585 <-> WEB-CLIENT Java Web Start arbitrary command execution attempt (web-client.rules, High) 16587 <-> SPECIFIC-THREATS Symantec multiple products AeXNSConsoleUtilities buffer overflow attempt (specific-threats.rules, High) 16588 <-> SPECIFIC-THREATS iseemedia LPViewer ActiveX exploit attempt (specific-threats.rules, High) 16589 <-> SPECIFIC-THREATS iseemedia LPViewer ActiveX buffer overflows attempt (specific-threats.rules, High) 16590 <-> SPECIFIC-THREATS EasyMail Objects ActiveX exploit attempt - 1 (specific-threats.rules, High) 16591 <-> SPECIFIC-THREATS EasyMail Objects ActiveX exploit attempt - 2 (specific-threats.rules, High) Updated rules: 2923 <-> NETBIOS SMB repeated logon failure (netbios.rules, High) 3085 <-> EXPLOIT AIM goaway message buffer overflow attempt (exploit.rules, Medium) 3143 <-> NETBIOS SMB Trans2 FIND_FIRST2 command response overflow attempt (netbios.rules, Low) 3218 <-> NETBIOS DCERPC NCACN-IP-TCP winreg OpenKey overflow attempt (netbios.rules, High) 3473 <-> WEB-CLIENT RealPlayer SMIL file overflow attempt (web-client.rules, High) 5797 <-> POLICY kontiki runtime detection (policy.rules, High) 6407 <-> POLICY Gizmo register VOIP state (policy.rules, High) 8053 <-> WEB-ACTIVEX DirectAnimation.PathControl ActiveX CLSID access (web-activex.rules, High) 8054 <-> WEB-ACTIVEX DirectAnimation.PathControl ActiveX CLSID unicode access (web-activex.rules, High) 8055 <-> WEB-ACTIVEX DirectAnimation.PathControl ActiveX function call access (web-activex.rules, High) 9814 <-> WEB-ACTIVEX ICQPhone.SipxPhoneManager ActiveX clsid access (web-activex.rules, High) 9815 <-> WEB-ACTIVEX ICQPhone.SipxPhoneManager ActiveX clsid unicode access (web-activex.rules, High) 9816 <-> WEB-ACTIVEX ICQPhone.SipxPhoneManager ActiveX function call access (web-activex.rules, High) 11673 <-> WEB-ACTIVEX Zenturi ProgramChecker ActiveX clsid access (web-activex.rules, High) 11674 <-> WEB-ACTIVEX Zenturi ProgramChecker ActiveX clsid unicode access (web-activex.rules, High) 11675 <-> WEB-ACTIVEX Zenturi ProgramChecker ActiveX function call access (web-activex.rules, High) 11676 <-> WEB-ACTIVEX Zenturi ProgramChecker ActiveX function call unicode access (web-activex.rules, High) 11822 <-> WEB-ACTIVEX Yahoo Webcam Upload ActiveX clsid access (web-activex.rules, High) 11823 <-> WEB-ACTIVEX Yahoo Webcam Upload ActiveX clsid unicode access (web-activex.rules, High) 11824 <-> WEB-ACTIVEX Yahoo Webcam Upload ActiveX function call access (web-activex.rules, High) 11825 <-> WEB-ACTIVEX Yahoo Webcam Upload ActiveX function call unicode access (web-activex.rules, High) 12010 <-> WEB-ACTIVEX RKD Software BarCode ActiveX clsid access (web-activex.rules, High) 12011 <-> WEB-ACTIVEX RKD Software BarCode ActiveX clsid unicode access (web-activex.rules, High) 12012 <-> WEB-ACTIVEX RKD Software BarCode ActiveX function call access (web-activex.rules, High) 12013 <-> WEB-ACTIVEX RKD Software BarCode ActiveX function call unicode access (web-activex.rules, High) 12087 <-> WEB-ACTIVEX McAfee NeoTrace ActiveX clsid access (web-activex.rules, High) 12088 <-> WEB-ACTIVEX McAfee NeoTrace ActiveX clsid unicode access (web-activex.rules, High) 12089 <-> WEB-ACTIVEX McAfee NeoTrace ActiveX function call access (web-activex.rules, High) 12090 <-> WEB-ACTIVEX McAfee NeoTrace ActiveX function call unicode access (web-activex.rules, High) 12095 <-> DELETED WEB-ACTIVEX Zenturi ProgramChecker ActiveX clsid access (deleted.rules, High) 12096 <-> DELETED WEB-ACTIVEX Zenturi ProgramChecker ActiveX clsid unicode access (deleted.rules, High) 12097 <-> DELETED WEB-ACTIVEX Zenturi ProgramChecker ActiveX function call access (deleted.rules, High) 12098 <-> DELETED WEB-ACTIVEX Zenturi ProgramChecker ActiveX function call unicode access (deleted.rules, High) 12384 <-> WEB-ACTIVEX Yahoo Messenger YVerInfo ActiveX clsid access (web-activex.rules, High) 12385 <-> WEB-ACTIVEX Yahoo Messenger YVerInfo ActiveX clsid unicode access (web-activex.rules, High) 12386 <-> WEB-ACTIVEX Yahoo Messenger YVerInfo ActiveX function call access (web-activex.rules, High) 12387 <-> WEB-ACTIVEX Yahoo Messenger YVerInfo ActiveX function call unicode access (web-activex.rules, High) 12434 <-> WEB-ACTIVEX BaoFeng Storm MPS.dll ActiveX clsid access (web-activex.rules, High) 12435 <-> WEB-ACTIVEX BaoFeng Storm MPS.dll ActiveX clsid unicode access (web-activex.rules, High) 13232 <-> WEB-ACTIVEX Persits Software XUpload ActiveX clsid access (web-activex.rules, High) 13233 <-> WEB-ACTIVEX Persits Software XUpload ActiveX clsid unicode access (web-activex.rules, High) 13234 <-> WEB-ACTIVEX Persits Software XUpload ActiveX function call access (web-activex.rules, High) 13235 <-> WEB-ACTIVEX Persits Software XUpload ActiveX function call unicode access (web-activex.rules, High) 13520 <-> EXPLOIT Winamp Ultravox streaming malicious metadata (exploit.rules, High) 13521 <-> EXPLOIT Winamp Ultravox streaming malicious metadata (exploit.rules, High) 13663 <-> IMAP Alt-N MDaemon IMAP Server FETCH command buffer overflow attempt (imap.rules, High) 13948 <-> DNS large number of NXDOMAIN replies - possible DNS cache poisoning (dns.rules, Medium) 14232 <-> WEB-ACTIVEX SoftArtisans XFile FileManager ActiveX clsid unicode access (web-activex.rules, High) 15436 <-> EXPLOIT IBM Tivoli Storage Manager Express Backup counter heap corruption attempt (exploit.rules, High) 15437 <-> EXPLOIT IBM Tivoli Storage Manager Express Backup message length heap corruption attempt (exploit.rules, High) 15473 <-> WEB-CLIENT Multiple media players M3U playlist file handling buffer overflow attempt (web-client.rules, High) 15698 <-> WEB-CLIENT Possible generic javascript heap spray attempt (web-client.rules, High) 16136 <-> SPYWARE-PUT Hijacker xp antispyware 2009 runtime detection - pre-sale webpage (spyware-put.rules, Low) 16305 <-> WEB-ACTIVEX Symantec Altiris Deployment Solution ActiveX clsid access (web-activex.rules, High) 16306 <-> WEB-ACTIVEX Symantec Altiris Deployment Solution ActiveX clsid unicode access (web-activex.rules, High) 16307 <-> WEB-ACTIVEX Symantec Altiris Deployment Solution ActiveX function call access (web-activex.rules, High) 16308 <-> WEB-ACTIVEX Symantec Altiris Deployment Solution ActiveX function call unicode access (web-activex.rules, High) 16547 <-> WEB-ACTIVEX Java Web Start ActiveX launch command by CLSID (web-activex.rules, High) 16548 <-> WEB-ACTIVEX Java Web Start ActiveX launch command by JavaScript CLSID (web-activex.rules, High) 16549 <-> WEB-CLIENT Oracle JRE Java Platform SE and Java Deployment Toolkit plugins code execution attempt - npruntime-scriptable-plugin (web-client.rules, High) 16550 <-> WEB-CLIENT Oracle JRE Java Platform SE and Java Deployment Toolkit plugins code execution attempt - java-deployment-toolkit (web-client.rules, High)
