Sourcefire VRT Rules Update
Date: 2009-02-20
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version CURRENT.
The format of the file is:
sid - Message (rule group, priority)
Updated rules: 13901 <-> NETBIOS SMB server response heap overflow attempt (netbios.rules, High) 15143 <-> SQL sp_replwritetovarbin unicode vulnerable function attempt (sql.rules, High) 15144 <-> SQL sp_replwritetovarbin vulnerable function attempt (sql.rules, High) 15319 <-> NETBIOS-DG SMB /sql/query create tree attempt (netbios.rules, Low) 15320 <-> NETBIOS-DG SMB /sql/query unicode create tree attempt (netbios.rules, Low) 15321 <-> NETBIOS SMB /sql/query create tree attempt (netbios.rules, Low) 15322 <-> NETBIOS SMB /sql/query unicode create tree attempt (netbios.rules, Low) 15323 <-> NETBIOS-DG SMB /sql/query andx create tree attempt (netbios.rules, Low) 15324 <-> NETBIOS-DG SMB /sql/query unicode andx create tree attempt (netbios.rules, Low) 15325 <-> NETBIOS SMB /sql/query andx create tree attempt (netbios.rules, Low) 15326 <-> NETBIOS SMB /sql/query unicode andx create tree attempt (netbios.rules, Low) New rules: 15307 <-> WEB-ACTIVEX Microsoft Animation Control ActiveX clsid access (web-activex.rules, High) 15308 <-> WEB-ACTIVEX Microsoft Animation Control ActiveX clsid unicode access (web-activex.rules, High) 15309 <-> WEB-ACTIVEX Microsoft Animation Control ActiveX function call access (web-activex.rules, High) 15310 <-> WEB-ACTIVEX Microsoft Animation Control ActiveX function call unicode access (web-activex.rules, High) 15311 <-> WEB-ACTIVEX Research In Motion AxLoader ActiveX clsid access (web-activex.rules, High) 15312 <-> WEB-ACTIVEX Research In Motion AxLoader ActiveX clsid unicode access (web-activex.rules, High) 15313 <-> WEB-ACTIVEX Research In Motion AxLoader ActiveX function call access (web-activex.rules, High) 15314 <-> WEB-ACTIVEX Research In Motion AxLoader ActiveX function call unicode access (web-activex.rules, High) 15315 <-> WEB-ACTIVEX Akamai DownloadManager ActiveX clsid access (web-activex.rules, High) 15316 <-> WEB-ACTIVEX Akamai DownloadManager ActiveX clsid unicode access (web-activex.rules, High) 15317 <-> WEB-ACTIVEX Akamai DownloadManager ActiveX function call access (web-activex.rules, High) 15318 <-> WEB-ACTIVEX Akamai DownloadManager ActiveX function call unicode access (web-activex.rules, High) 15330 <-> WEB-ACTIVEX Nokia Phoenix Service 1 ActiveX clsid access (web-activex.rules, High) 15331 <-> WEB-ACTIVEX Nokia Phoenix Service 1 ActiveX clsid unicode access (web-activex.rules, High) 15332 <-> WEB-ACTIVEX Nokia Phoenix Service 2 ActiveX clsid access (web-activex.rules, High) 15333 <-> WEB-ACTIVEX Nokia Phoenix Service 2 ActiveX clsid unicode access (web-activex.rules, High) 15334 <-> WEB-ACTIVEX GeoVision LiveX 7000 ActiveX clsid access (web-activex.rules, High) 15335 <-> WEB-ACTIVEX GeoVision LiveX 7000 ActiveX clsid unicode access (web-activex.rules, High) 15336 <-> WEB-ACTIVEX GeoVision LiveX 7000 ActiveX function call access (web-activex.rules, High) 15337 <-> WEB-ACTIVEX GeoVision LiveX 7000 ActiveX function call unicode access (web-activex.rules, High) 15338 <-> WEB-ACTIVEX GeoVision LiveX 8120 ActiveX clsid access (web-activex.rules, High) 15339 <-> WEB-ACTIVEX GeoVision LiveX 8120 ActiveX clsid unicode access (web-activex.rules, High) 15340 <-> WEB-ACTIVEX GeoVision LiveX 8120 ActiveX function call access (web-activex.rules, High) 15341 <-> WEB-ACTIVEX GeoVision LiveX 8120 ActiveX function call unicode access (web-activex.rules, High) 15342 <-> WEB-ACTIVEX GeoVision LiveX 8200 ActiveX clsid access (web-activex.rules, High) 15343 <-> WEB-ACTIVEX GeoVision LiveX 8200 ActiveX clsid unicode access (web-activex.rules, High) 15344 <-> WEB-ACTIVEX GeoVision LiveX 8200 ActiveX function call access (web-activex.rules, High) 15345 <-> WEB-ACTIVEX GeoVision LiveX 8200 ActiveX function call unicode access (web-activex.rules, High) 15346 <-> WEB-ACTIVEX Synactis ALL In-The-Box ActiveX clsid access (web-activex.rules, High) 15347 <-> WEB-ACTIVEX Synactis ALL In-The-Box ActiveX clsid unicode access (web-activex.rules, High) 15348 <-> WEB-ACTIVEX Synactis ALL In-The-Box ActiveX function call access (web-activex.rules, High) 15349 <-> WEB-ACTIVEX Synactis ALL In-The-Box ActiveX function call unicode access (web-activex.rules, High) 15350 <-> WEB-ACTIVEX Web on Windows ActiveX clsid access (web-activex.rules, High) 15351 <-> WEB-ACTIVEX Web on Windows ActiveX clsid unicode access (web-activex.rules, High) 15352 <-> WEB-ACTIVEX Web on Windows ActiveX function call access (web-activex.rules, High) 15353 <-> WEB-ACTIVEX Web on Windows ActiveX function call unicode access (web-activex.rules, High) 15356 <-> SMTP Adobe PDF JBIG2 remote code execution attempt (smtp.rules, High) 15357 <-> WEB-CLIENT Adobe PDF JBIG2 remote code execution attempt (web-client.rules, High)
