Sourcefire VRT Update
Date: 2006-12-12
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack.
The format of the file is:
sid - Message (rule group)
New rules: 9622 <-> DOS Spiffit UDP denial of service attempt (dos.rules) 9623 <-> RPC UNIX authentication machinename string overflow attempt TCP (rpc.rules) 9624 <-> RPC UNIX authentication machinename string overflow attempt UDP (rpc.rules) 9625 <-> WEB-CLIENT Windows Media Player ASX file ref href buffer overflow attempt (web-client.rules) 9626 <-> WEB-CLIENT AcroPDF.PDF ActiveX clsid access (web-client.rules) 9627 <-> WEB-CLIENT AcroPDF.PDF ActiveX clsid unicode access (web-client.rules) 9628 <-> WEB-CLIENT javaprxy.dll ActiveX clsid unicode access (web-client.rules) 9629 <-> WEB-CLIENT Citrix.ICAClient ActiveX clsid access (web-client.rules) 9630 <-> WEB-CLIENT Citrix.ICAClient ActiveX clsid unicode access (web-client.rules) 9631 <-> WEB-CLIENT Citrix.ICAClient ActiveX function call access (web-client.rules) 9632 <-> EXPLOIT Tivoli Storage Manager command request buffer overflow attempt (exploit.rules) 9633 <-> EXPLOIT Computer Associates Product Discovery Service type 9B remote buffer overflow attempt TCP (exploit.rules) 9634 <-> EXPLOIT Computer Associates Product Discovery Service type 9C remote buffer overflow attempt TCP (exploit.rules) 9635 <-> EXPLOIT Computer Associates Product Discovery Service type 9B remote buffer overflow attempt UDP (exploit.rules) 9636 <-> EXPLOIT Computer Associates Product Discovery Service type 9C remote buffer overflow attempt UDP (exploit.rules) 9637 <-> WEB-CLIENT Adobe Download Manger dm.ini stack overflow attempt (web-client.rules) 9638 <-> TFTP PUT Microsoft RIS filename overwrite attempt (tftp.rules) 9639 <-> WEB-CLIENT Windows Address Book download attempt (web-client.rules) Updated rules: 6412 <-> SMTP Windows Address Book attachment detected (smtp.rules) 6413 <-> SMTP Base64 encoded Windows Address Book attachment detected (smtp.rules) 6516 <-> WEB-CLIENT DXImageTransform.Microsoft.Light ActiveX function call access (web-client.rules) 6682 <-> WEB-CLIENT DXImageTransform.Microsoft.MMSpecialEffect2Inputs ActiveX function call access (web-client.rules) 6687 <-> WEB-CLIENT DXImageTransform.Microsoft.MMSpecialEffect1Input ActiveX function call access (web-client.rules) 7004 <-> WEB-CLIENT Internet.HHCtrl.1 ActiveX function call access (web-client.rules) 7006 <-> WEB-CLIENT ASControls.InstallEngineCtl ActiveX function call access (web-client.rules) 7007 <-> WEB-CLIENT AxDebugger.Document.1 ActiveX function call access (web-client.rules) 7008 <-> WEB-CLIENT DirectAnimation.DAUserData ActiveX function call access (web-client.rules) 7009 <-> WEB-CLIENT DirectAnimation.StructuredGraphicsControl ActiveX function call access (web-client.rules) 7010 <-> WEB-CLIENT HtmlDlgSafeHelper.HtmlDlgSafeHelper.1 ActiveX function call access (web-client.rules) 7011 <-> WEB-CLIENT HtmlDlgSafeHelper.HtmlDlgSafeHelper ActiveX function call access (web-client.rules) 7012 <-> WEB-CLIENT Internet.PopupMenu.1 ActiveX function call access (web-client.rules) 7013 <-> WEB-CLIENT Microsoft.ISCatAdm ActiveX function call access (web-client.rules) 7014 <-> WEB-CLIENT NMSA.ASFSourceMediaDescription.1 ActiveX function call access (web-client.rules) 7015 <-> WEB-CLIENT NMSA.MediaDescription ActiveX function call access (web-client.rules) 7016 <-> WEB-CLIENT Object.Microsoft.DXTFilter ActiveX function call access (web-client.rules) 7017 <-> WEB-CLIENT RDS.DataControl ActiveX function call access (web-client.rules) 7018 <-> WEB-CLIENT Sysmon ActiveX function call access (web-client.rules) 7026 <-> WEB-CLIENT RDS.Dataspace ActiveX function call access (web-client.rules) 7862 <-> WEB-CLIENT McSubMgr.IsAppExpired ActiveX function call access (web-client.rules) 7863 <-> WEB-CLIENT McSubMgr.IsOldAppInstalled ActiveX function call access (web-client.rules) 7980 <-> WEB-CLIENT ShockwaveFlash.ShockwaveFlash.9 ActiveX function call access (web-client.rules) 8055 <-> WEB-CLIENT DirectAnimation.PathControl ActiveX function call access (web-client.rules) 8063 <-> WEB-CLIENT ADODB.Stream ActiveX function call access (web-client.rules) 8068 <-> WEB-CLIENT Windows Scripting Host Shell ActiveX function call access (web-client.rules) 8369 <-> WEB-CLIENT WMIScriptUtils.WMIObjectBroker2.1 ActiveX CLSID access (web-client.rules) 8370 <-> WEB-CLIENT WMIScriptUtils.WMIObjectBroker2.1 ActiveX CLSID unicode access (web-client.rules) 8416 <-> WEB-CLIENT VML fill method overflow attempt (web-client.rules) 8417 <-> WEB-CLIENT TriEditDocument.TriEditDocument ActiveX function call access (web-client.rules) 8418 <-> WEB-CLIENT DXImageTransform.Microsoft.RevealTrans ActiveX function call access (web-client.rules) 8419 <-> WEB-CLIENT WebViewFolderIcon.WebViewFolderIcon.1 ActiveX function call access (web-client.rules) 8420 <-> WEB-CLIENT DXImageTransform.Microsoft.Gradient ActiveX function call access (web-client.rules) 8421 <-> WEB-CLIENT OWC11.DataSourceControl.11 ActiveX function call access (web-client.rules) 8422 <-> WEB-CLIENT OVCtl.OVCtl.1 ActiveX function call access (web-client.rules) 8423 <-> WEB-CLIENT CEnroll.CEnroll.2 ActiveX function call access (web-client.rules) 8424 <-> WEB-CLIENT Microsoft Forms 2.0 ListBox ActiveX function call access (web-client.rules) 8425 <-> WEB-CLIENT DXImageTransform.Microsoft.NDFXArtEffects ActiveX function call access (web-client.rules)
