Sourcefire VRT Rules Update

Date: 2009-07-07

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version CURRENT.

The format of the file is:

sid - Message (rule group, priority)

New rules:
15585 <-> WEB-CLIENT Excel file download request (web-client.rules, Low)
15586 <-> WEB-CLIENT Powerpoint file download request (web-client.rules, Low)
15587 <-> WEB-CLIENT Word file download request (web-client.rules, Low)
15588 <-> WEB-ACTIVEX Microsoft Video 1 ActiveX clsid access (web-activex.rules, High)
15589 <-> WEB-ACTIVEX Microsoft Video 1 ActiveX clsid unicode access (web-activex.rules, High)
15590 <-> WEB-ACTIVEX Microsoft Video 10 ActiveX clsid access (web-activex.rules, High)
15591 <-> WEB-ACTIVEX Microsoft Video 10 ActiveX clsid unicode access (web-activex.rules, High)
15592 <-> WEB-ACTIVEX Microsoft Video 11 ActiveX clsid access (web-activex.rules, High)
15593 <-> WEB-ACTIVEX Microsoft Video 11 ActiveX clsid unicode access (web-activex.rules, High)
15594 <-> WEB-ACTIVEX Microsoft Video 12 ActiveX clsid access (web-activex.rules, High)
15595 <-> WEB-ACTIVEX Microsoft Video 12 ActiveX clsid unicode access (web-activex.rules, High)
15596 <-> WEB-ACTIVEX Microsoft Video 13 ActiveX clsid access (web-activex.rules, High)
15597 <-> WEB-ACTIVEX Microsoft Video 13 ActiveX clsid unicode access (web-activex.rules, High)
15598 <-> WEB-ACTIVEX Microsoft Video 14 ActiveX clsid access (web-activex.rules, High)
15599 <-> WEB-ACTIVEX Microsoft Video 14 ActiveX clsid unicode access (web-activex.rules, High)
15600 <-> WEB-ACTIVEX Microsoft Video 15 ActiveX clsid access (web-activex.rules, High)
15601 <-> WEB-ACTIVEX Microsoft Video 15 ActiveX clsid unicode access (web-activex.rules, High)
15602 <-> WEB-ACTIVEX Microsoft Video 16 ActiveX clsid access (web-activex.rules, High)
15603 <-> WEB-ACTIVEX Microsoft Video 16 ActiveX clsid unicode access (web-activex.rules, High)
15604 <-> WEB-ACTIVEX Microsoft Video 17 ActiveX clsid access (web-activex.rules, High)
15605 <-> WEB-ACTIVEX Microsoft Video 17 ActiveX clsid unicode access (web-activex.rules, High)
15606 <-> WEB-ACTIVEX Microsoft Video 18 ActiveX clsid access (web-activex.rules, High)
15607 <-> WEB-ACTIVEX Microsoft Video 18 ActiveX clsid unicode access (web-activex.rules, High)
15608 <-> WEB-ACTIVEX Microsoft Video 19 ActiveX clsid access (web-activex.rules, High)
15609 <-> WEB-ACTIVEX Microsoft Video 19 ActiveX clsid unicode access (web-activex.rules, High)
15610 <-> WEB-ACTIVEX Microsoft Video 2 ActiveX clsid access (web-activex.rules, High)
15611 <-> WEB-ACTIVEX Microsoft Video 2 ActiveX clsid unicode access (web-activex.rules, High)
15612 <-> WEB-ACTIVEX Microsoft Video 20 ActiveX clsid access (web-activex.rules, High)
15613 <-> WEB-ACTIVEX Microsoft Video 20 ActiveX clsid unicode access (web-activex.rules, High)
15614 <-> WEB-ACTIVEX Microsoft Video 21 ActiveX clsid access (web-activex.rules, High)
15615 <-> WEB-ACTIVEX Microsoft Video 21 ActiveX clsid unicode access (web-activex.rules, High)
15616 <-> WEB-ACTIVEX Microsoft Video 22 ActiveX clsid access (web-activex.rules, High)
15617 <-> WEB-ACTIVEX Microsoft Video 22 ActiveX clsid unicode access (web-activex.rules, High)
15618 <-> WEB-ACTIVEX Microsoft Video 23 ActiveX clsid access (web-activex.rules, High)
15619 <-> WEB-ACTIVEX Microsoft Video 23 ActiveX clsid unicode access (web-activex.rules, High)
15620 <-> WEB-ACTIVEX Microsoft Video 24 ActiveX clsid access (web-activex.rules, High)
15621 <-> WEB-ACTIVEX Microsoft Video 24 ActiveX clsid unicode access (web-activex.rules, High)
15622 <-> WEB-ACTIVEX Microsoft Video 25 ActiveX clsid access (web-activex.rules, High)
15623 <-> WEB-ACTIVEX Microsoft Video 25 ActiveX clsid unicode access (web-activex.rules, High)
15624 <-> WEB-ACTIVEX Microsoft Video 26 ActiveX clsid access (web-activex.rules, High)
15625 <-> WEB-ACTIVEX Microsoft Video 26 ActiveX clsid unicode access (web-activex.rules, High)
15626 <-> WEB-ACTIVEX Microsoft Video 27 ActiveX clsid access (web-activex.rules, High)
15627 <-> WEB-ACTIVEX Microsoft Video 27 ActiveX clsid unicode access (web-activex.rules, High)
15628 <-> WEB-ACTIVEX Microsoft Video 28 ActiveX clsid access (web-activex.rules, High)
15629 <-> WEB-ACTIVEX Microsoft Video 28 ActiveX clsid unicode access (web-activex.rules, High)
15630 <-> WEB-ACTIVEX Microsoft Video 29 ActiveX clsid access (web-activex.rules, High)
15631 <-> WEB-ACTIVEX Microsoft Video 29 ActiveX clsid unicode access (web-activex.rules, High)
15632 <-> WEB-ACTIVEX Microsoft Video 3 ActiveX clsid access (web-activex.rules, High)
15633 <-> WEB-ACTIVEX Microsoft Video 3 ActiveX clsid unicode access (web-activex.rules, High)
15634 <-> WEB-ACTIVEX Microsoft Video 30 ActiveX clsid access (web-activex.rules, High)
15635 <-> WEB-ACTIVEX Microsoft Video 30 ActiveX clsid unicode access (web-activex.rules, High)
15636 <-> WEB-ACTIVEX Microsoft Video 31 ActiveX clsid access (web-activex.rules, High)
15637 <-> WEB-ACTIVEX Microsoft Video 31 ActiveX clsid unicode access (web-activex.rules, High)
15638 <-> WEB-ACTIVEX Microsoft Video 32 ActiveX clsid access (web-activex.rules, High)
15639 <-> WEB-ACTIVEX Microsoft Video 32 ActiveX clsid unicode access (web-activex.rules, High)
15640 <-> WEB-ACTIVEX Microsoft Video 33 ActiveX clsid access (web-activex.rules, High)
15641 <-> WEB-ACTIVEX Microsoft Video 33 ActiveX clsid unicode access (web-activex.rules, High)
15642 <-> WEB-ACTIVEX Microsoft Video 34 ActiveX clsid access (web-activex.rules, High)
15643 <-> WEB-ACTIVEX Microsoft Video 34 ActiveX clsid unicode access (web-activex.rules, High)
15644 <-> WEB-ACTIVEX Microsoft Video 35 ActiveX clsid access (web-activex.rules, High)
15645 <-> WEB-ACTIVEX Microsoft Video 35 ActiveX clsid unicode access (web-activex.rules, High)
15646 <-> WEB-ACTIVEX Microsoft Video 36 ActiveX clsid access (web-activex.rules, High)
15647 <-> WEB-ACTIVEX Microsoft Video 36 ActiveX clsid unicode access (web-activex.rules, High)
15648 <-> WEB-ACTIVEX Microsoft Video 37 ActiveX clsid access (web-activex.rules, High)
15649 <-> WEB-ACTIVEX Microsoft Video 37 ActiveX clsid unicode access (web-activex.rules, High)
15650 <-> WEB-ACTIVEX Microsoft Video 38 ActiveX clsid access (web-activex.rules, High)
15651 <-> WEB-ACTIVEX Microsoft Video 38 ActiveX clsid unicode access (web-activex.rules, High)
15652 <-> WEB-ACTIVEX Microsoft Video 39 ActiveX clsid access (web-activex.rules, High)
15653 <-> WEB-ACTIVEX Microsoft Video 39 ActiveX clsid unicode access (web-activex.rules, High)
15654 <-> WEB-ACTIVEX Microsoft Video 4 ActiveX clsid access (web-activex.rules, High)
15655 <-> WEB-ACTIVEX Microsoft Video 4 ActiveX clsid unicode access (web-activex.rules, High)
15656 <-> WEB-ACTIVEX Microsoft Video 40 ActiveX clsid access (web-activex.rules, High)
15657 <-> WEB-ACTIVEX Microsoft Video 40 ActiveX clsid unicode access (web-activex.rules, High)
15658 <-> WEB-ACTIVEX Microsoft Video 41 ActiveX clsid access (web-activex.rules, High)
15659 <-> WEB-ACTIVEX Microsoft Video 41 ActiveX clsid unicode access (web-activex.rules, High)
15660 <-> WEB-ACTIVEX Microsoft Video 42 ActiveX clsid access (web-activex.rules, High)
15661 <-> WEB-ACTIVEX Microsoft Video 42 ActiveX clsid unicode access (web-activex.rules, High)
15662 <-> WEB-ACTIVEX Microsoft Video 43 ActiveX clsid access (web-activex.rules, High)
15663 <-> WEB-ACTIVEX Microsoft Video 43 ActiveX clsid unicode access (web-activex.rules, High)
15664 <-> WEB-ACTIVEX Microsoft Video 44 ActiveX clsid access (web-activex.rules, High)
15665 <-> WEB-ACTIVEX Microsoft Video 44 ActiveX clsid unicode access (web-activex.rules, High)
15666 <-> WEB-ACTIVEX Microsoft Video 45 ActiveX clsid access (web-activex.rules, High)
15667 <-> WEB-ACTIVEX Microsoft Video 45 ActiveX clsid unicode access (web-activex.rules, High)
15668 <-> WEB-ACTIVEX Microsoft Video 5 ActiveX clsid access (web-activex.rules, High)
15669 <-> WEB-ACTIVEX Microsoft Video 5 ActiveX clsid unicode access (web-activex.rules, High)
15670 <-> WEB-ACTIVEX Microsoft Video 6 ActiveX clsid access (web-activex.rules, High)
15671 <-> WEB-ACTIVEX Microsoft Video 6 ActiveX clsid unicode access (web-activex.rules, High)
15672 <-> WEB-ACTIVEX Microsoft Video 7 ActiveX clsid access (web-activex.rules, High)
15673 <-> WEB-ACTIVEX Microsoft Video 7 ActiveX clsid unicode access (web-activex.rules, High)
15674 <-> WEB-ACTIVEX Microsoft Video 8 ActiveX clsid access (web-activex.rules, High)
15675 <-> WEB-ACTIVEX Microsoft Video 8 ActiveX clsid unicode access (web-activex.rules, High)
15676 <-> WEB-ACTIVEX Microsoft Video 9 ActiveX clsid access (web-activex.rules, High)
15677 <-> WEB-ACTIVEX Microsoft Video 9 ActiveX clsid unicode access (web-activex.rules, High)

Updated rules:
7024 <-> WEB-CLIENT excel style handling overflow attempt (web-client.rules, High)
7047 <-> WEB-CLIENT excel object record overflow attempt (web-client.rules, High)
7199 <-> WEB-CLIENT excel label record overflow attempt (web-client.rules, High)
7204 <-> WEB-CLIENT excel object ftCmo overflow attempt (web-client.rules, High)
7205 <-> WEB-CLIENT excel FngGroupCount record overflow attempt (web-client.rules, High)
8448 <-> WEB-CLIENT Excel colinfo XF record overflow attempt (web-client.rules, High)
9847 <-> WEB-CLIENT Outlook Saved Search download attempt (web-client.rules, High)
11258 <-> WEB-CLIENT Excel Malformed Named Graph Information unicode overflow (web-client.rules, High)
11290 <-> WEB-CLIENT Excel malformed named graph information ascii overflow (web-client.rules, High)
12070 <-> EXPLOIT Microsoft Excel malformed version field (exploit.rules, High)
12099 <-> MISC Microsoft Excel rtWindow1 record handling arbitrary code execution attempt (misc.rules, High)
12184 <-> MISC Microsoft Excel workbook workspace designation handling arbitrary code execution attempt (misc.rules, High)
12256 <-> WEB-CLIENT Excel malformed FBI record (web-client.rules, High)