Snort

Sourcefire VRT Update

Date: 2007-02-20

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack.

The format of the file is:

sid - Message (rule group)

New rules:
10156 <-> WEB-CLIENT ActiveX Soft DVD Tools ActiveX clsid access (web-client.rules)
10157 <-> WEB-CLIENT ActiveX Soft DVD Tools ActiveX clsid unicode access (web-client.rules)
10158 <-> NETBIOS SMB writex possible Snort dcerpc preprocessor overflow attempt (netbios.rules)
10159 <-> NETBIOS SMB-DS writex possible Snort dcerpc preprocessor overflow attempt (netbios.rules)
10160 <-> NETBIOS-DG SMB writex possible Snort dcerpc preprocessor overflow attempt (netbios.rules)
10161 <-> NETBIOS SMB write_andx overflow attempt (shared object rule)