Sourcefire VRT Rules Update
Date: 2008-11-11
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version CURRENT.
The format of the file is:
sid - Message (rule group)
New rules: 14993 <-> WEB-CLIENT Visagesoft eXPert PDF Viewer ActiveX clsid access (web-client.rules) 14994 <-> WEB-CLIENT Visagesoft eXPert PDF Viewer ActiveX clsid unicode access (web-client.rules) 14995 <-> WEB-CLIENT Visagesoft eXPert PDF Viewer ActiveX function call access (web-client.rules) 14996 <-> WEB-CLIENT Visagesoft eXPert PDF Viewer ActiveX function call unicode access (web-client.rules) 14997 <-> WEB-CLIENT DjVu MSOffice Converter ActiveX clsid access (web-client.rules) 14998 <-> WEB-CLIENT DjVu MSOffice Converter ActiveX clsid unicode access (web-client.rules) 14999 <-> WEB-CLIENT Microsoft Debug Diagnostic Tool ActiveX clsid access (web-client.rules) 15000 <-> WEB-CLIENT Microsoft Debug Diagnostic Tool ActiveX clsid unicode access (web-client.rules) 15001 <-> WEB-CLIENT Microsoft Debug Diagnostic Tool ActiveX function call access (web-client.rules) 15002 <-> WEB-CLIENT Microsoft Debug Diagnostic Tool ActiveX function call unicode access (web-client.rules) 15003 <-> WEB-CLIENT Chilkat Crypt 2 ActiveX clsid access (web-client.rules) 15004 <-> WEB-CLIENT Chilkat Crypt 2 ActiveX clsid unicode access (web-client.rules) 15005 <-> WEB-CLIENT Chilkat Crypt 2 ActiveX function call access (web-client.rules) 15006 <-> WEB-CLIENT Chilkat Crypt 2 ActiveX function call unicode access (web-client.rules) 15007 <-> WEB-CLIENT NOS Microsystems getPlus Download Manager ActiveX clsid access (web-client.rules) 15008 <-> WEB-CLIENT NOS Microsystems getPlus Download Manager ActiveX clsid unicode access (web-client.rules) 15013 <-> WEB-MISC Adobe Portable Document Format file download attempt (web-misc.rules) 15014 <-> WEB-CLIENT Adobe Reader and Acrobat util.printf buffer overflow attempt (web-client.rules) Updated rules: 3693 <-> WEB-MISC IBM WebSphere j_security_check overflow attempt (web-misc.rules) 6469 <-> EXPLOIT RealVNC connection attempt (exploit.rules) 6470 <-> EXPLOIT RealVNC authentication types sent attempt (exploit.rules) 6471 <-> EXPLOIT RealVNC password authentication bypass vulnerability attempt (exploit.rules)
