Sourcefire VRT Rules Update
Date: 2007-10-02
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version CURRENT.
The format of the file is:
sid - Message (rule group)
New rules: 12596 <-> EXPLOIT CA BrightStor LGServer username buffer overflow attempt (exploit.rules) 12597 <-> DOS utf8 filename transfer attempt (dos.rules) 12598 <-> WEB-CLIENT Xunlei Web Thunder ActiveX clsid access (web-client.rules) 12599 <-> WEB-CLIENT Xunlei Web Thunder ActiveX clsid unicode access (web-client.rules) 12600 <-> WEB-CLIENT ebCrypt IncrementalHash ActiveX clsid access (web-client.rules) 12601 <-> WEB-CLIENT ebCrypt IncrementalHash ActiveX clsid unicode access (web-client.rules) 12602 <-> WEB-CLIENT ebCrypt IncrementalHash ActiveX function call access (web-client.rules) 12603 <-> WEB-CLIENT ebCrypt IncrementalHash ActiveX function call unicode access (web-client.rules) 12604 <-> WEB-CLIENT ebCrypt PRNGenerator ActiveX clsid access (web-client.rules) 12605 <-> WEB-CLIENT ebCrypt PRNGenerator ActiveX clsid unicode access (web-client.rules) 12606 <-> WEB-CLIENT ebCrypt PRNGenerator ActiveX function call access (web-client.rules) 12607 <-> WEB-CLIENT ebCrypt PRNGenerator ActiveX function call unicode access (web-client.rules) Updated rules: 638 <-> SHELLCODE SGI NOOP (shellcode.rules) 639 <-> SHELLCODE SGI NOOP (shellcode.rules) 640 <-> SHELLCODE AIX NOOP (shellcode.rules) 641 <-> SHELLCODE Digital UNIX NOOP (shellcode.rules) 642 <-> SHELLCODE HP-UX NOOP (shellcode.rules) 643 <-> SHELLCODE HP-UX NOOP (shellcode.rules) 644 <-> SHELLCODE sparc NOOP (shellcode.rules) 645 <-> SHELLCODE sparc NOOP (shellcode.rules) 646 <-> SHELLCODE sparc NOOP (shellcode.rules) 647 <-> SHELLCODE sparc setuid 0 (shellcode.rules) 648 <-> SHELLCODE x86 NOOP (shellcode.rules) 649 <-> SHELLCODE x86 setgid 0 (shellcode.rules) 650 <-> SHELLCODE x86 setuid 0 (shellcode.rules) 651 <-> SHELLCODE x86 stealth NOOP (shellcode.rules) 652 <-> SHELLCODE Linux shellcode (shellcode.rules) 653 <-> SHELLCODE x86 0x90 unicode NOOP (shellcode.rules) 1390 <-> SHELLCODE x86 inc ebx NOOP (shellcode.rules) 1394 <-> SHELLCODE x86 NOOP (shellcode.rules) 1424 <-> SHELLCODE x86 0xEB0C NOOP (shellcode.rules) 2312 <-> SHELLCODE x86 0x71FB7BAB NOOP (shellcode.rules) 2313 <-> SHELLCODE x86 0x71FB7BAB NOOP unicode (shellcode.rules) 2314 <-> DELETED SHELLCODE x86 0x90 NOOP unicode (deleted.rules) 8426 <-> WEB-MISC SSLv2 openssl get shared ciphers overflow attempt (web-misc.rules) 8427 <-> WEB-MISC SSLv3 openssl get shared ciphers overflow attempt (web-misc.rules) 8428 <-> WEB-MISC SSLv2 openssl get shared ciphers overflow attempt (web-misc.rules) 8429 <-> POP3 SSLv2 openssl get shared ciphers overflow attempt (pop3.rules) 8430 <-> POP3 SSLv3 openssl get shared ciphers overflow attempt (pop3.rules) 8431 <-> POP3 SSLv2 openssl get shared ciphers overflow attempt (pop3.rules) 8432 <-> SMTP SSLv2 openssl get shared ciphers overflow attempt (smtp.rules) 8433 <-> SMTP SSLv2 openssl get shared ciphers overflow attempt (smtp.rules) 8434 <-> SMTP SSLv3 openssl get shared ciphers overflow attempt (smtp.rules) 8435 <-> SMTP SSLv3 openssl get shared ciphers overflow attempt (smtp.rules) 8436 <-> SMTP SSLv2 openssl get shared ciphers overflow attempt (smtp.rules) 8437 <-> SMTP SSLv2 openssl get shared ciphers overflow attempt (smtp.rules) 8438 <-> IMAP SSLv2 openssl get shared ciphers overflow attempt (imap.rules) 8439 <-> IMAP SSLv3 openssl get shared ciphers overflow attempt (imap.rules) 8440 <-> IMAP SSLv2 openssl get shared ciphers overflow attempt (imap.rules) 10506 <-> SHELLCODE Canvas shellcode basic encoder (shellcode.rules) 10507 <-> SHELLCODE Canvas shellcode basic encoder (shellcode.rules) 10508 <-> SHELLCODE Canvas shellcode basic encoder (shellcode.rules) 10509 <-> SHELLCODE Canvas shellcode basic encoder (shellcode.rules) 10510 <-> SHELLCODE Canvas shellcode basic encoder (shellcode.rules) 10511 <-> SHELLCODE Canvas shellcode basic encoder (shellcode.rules) 10512 <-> SHELLCODE Canvas shellcode basic encoder (shellcode.rules) 10513 <-> SHELLCODE Canvas shellcode basic encoder (shellcode.rules) 12466 <-> WEB-CLIENT MW6 Technologies QRCode ActiveX clsid access (web-client.rules) 12467 <-> WEB-CLIENT MW6 Technologies QRCode ActiveX clsid unicode access (web-client.rules) 12468 <-> WEB-CLIENT COWON America JetAudio JetFlExt.dll ActiveX clsid access (web-client.rules) 12469 <-> WEB-CLIENT COWON America JetAudio JetFlExt.dll ActiveX clsid unicode access (web-client.rules) 12470 <-> WEB-CLIENT COWON America JetAudio JetFlExt.dll ActiveX function call access (web-client.rules) 12471 <-> WEB-CLIENT COWON America JetAudio JetFlExt.dll ActiveX function call unicode access (web-client.rules) 12472 <-> WEB-CLIENT Sun Java Web Start ActiveX clsid access (web-client.rules) 12473 <-> WEB-CLIENT Sun Java Web Start ActiveX clsid unicode access (web-client.rules) 12474 <-> WEB-CLIENT Sun Java Web Start ActiveX function call access (web-client.rules) 12475 <-> WEB-CLIENT Sun Java Web Start ActiveX function call unicode access (web-client.rules) 12476 <-> WEB-CLIENT Yahoo Messenger CYFT ActiveX clsid access (web-client.rules) 12477 <-> WEB-CLIENT Yahoo Messenger CYFT ActiveX clsid unicode access (web-client.rules) 12478 <-> WEB-CLIENT Yahoo Messenger CYFT ActiveX function call access (web-client.rules) 12479 <-> WEB-CLIENT Yahoo Messenger CYFT ActiveX function call unicode access (web-client.rules) 12593 <-> EXPLOIT Firefox Quicktime chrome exploit (exploit.rules)
