Talos Rules 2016-06-16
This release adds and modifies rules in several categories.

Talos has added and modified multiple rules in the file-flash and server-webapp rule sets to provide coverage for emerging threats from these technologies.

For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.

Change logs

2976

2016-06-17 00:36:59 UTC

Snort Subscriber Rules Update

Date: 2016-06-16

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2976.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:39314 <-> DISABLED <-> FILE-FLASH Adobe Flash Player RegExp numbered backreference out of bounds read attempt (file-flash.rules)
 * 1:39304 <-> ENABLED <-> FILE-FLASH Adobe Flash Player Primetime SDK ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:39264 <-> DISABLED <-> FILE-FLASH Adobe Flash Player unhandled recursion limit out of bounds read attempt (file-flash.rules)
 * 1:39318 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimOpportunityGenerator out of bounds memory access attempt (file-flash.rules)
 * 1:39319 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimOpportunityGenerator out of bounds memory access attempt (file-flash.rules)
 * 1:39316 <-> ENABLED <-> FILE-FLASH Adobe Flash Player MovieClip object use-after-free attempt (file-flash.rules)
 * 1:39310 <-> ENABLED <-> FILE-FLASH Adobe Flash Player same origin policy security bypass attempt (file-flash.rules)
 * 1:39315 <-> DISABLED <-> FILE-FLASH Adobe Flash Player RegExp numbered backreference out of bounds read attempt (file-flash.rules)
 * 1:39309 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed ATF file length load buffer overflow attempt (file-flash.rules)
 * 1:39305 <-> ENABLED <-> FILE-FLASH Adobe Flash Player Primetime SDK ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:39317 <-> ENABLED <-> FILE-FLASH Adobe Flash Player MovieClip object use-after-free attempt (file-flash.rules)
 * 1:39262 <-> DISABLED <-> FILE-FLASH Adobe Flash Player unhandled recursion limit out of bounds read attempt (file-flash.rules)
 * 1:39263 <-> DISABLED <-> FILE-FLASH Adobe Flash Player unhandled recursion limit out of bounds read attempt (file-flash.rules)
 * 1:39265 <-> DISABLED <-> FILE-FLASH Adobe Flash Player unhandled recursion limit out of bounds read attempt (file-flash.rules)
 * 1:39268 <-> DISABLED <-> SERVER-WEBAPP Joomla PayPlans Extension com_payplans group_id SQL injection attempt (server-webapp.rules)
 * 1:39269 <-> ENABLED <-> FILE-FLASH Adobe Flash TextFormat.setTabStops use-after-free attempt (file-flash.rules)
 * 1:39270 <-> ENABLED <-> FILE-FLASH Adobe Flash TextFormat.setTabStops use-after-free attempt (file-flash.rules)
 * 1:39271 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimContentFactory uninitialized pointer use attempt (file-flash.rules)
 * 1:39272 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimContentFactory uninitialized pointer use attempt (file-flash.rules)
 * 1:39273 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed ATF heap overflow attempt (file-flash.rules)
 * 1:39274 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed ATF heap overflow attempt (file-flash.rules)
 * 1:39275 <-> ENABLED <-> FILE-FLASH Adobe Flash Player loadSound use after free attempt (file-flash.rules)
 * 1:39276 <-> ENABLED <-> FILE-FLASH Adobe Flash Player loadSound use after free attempt (file-flash.rules)
 * 1:39277 <-> ENABLED <-> FILE-OTHER Adobe Flash Player malformed JPEG XR heap overflow attempt (file-other.rules)
 * 1:39278 <-> ENABLED <-> FILE-OTHER Adobe Flash Player malformed JPEG XR heap overflow attempt (file-other.rules)
 * 1:39279 <-> ENABLED <-> FILE-FLASH Adobe Primetime SDK object type confusion overflow attempt (file-flash.rules)
 * 1:39280 <-> ENABLED <-> FILE-FLASH Adobe Primetime SDK object type confusion overflow attempt (file-flash.rules)
 * 1:39281 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed JPEG-XR out of bounds memory access attempt (file-flash.rules)
 * 1:39282 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed JPEG-XR out of bounds memory access attempt (file-flash.rules)
 * 1:39283 <-> ENABLED <-> FILE-FLASH Adobe Flash Player loadSound use after free attempt (file-flash.rules)
 * 1:39284 <-> ENABLED <-> FILE-FLASH Adobe Flash Player loadSound use after free attempt (file-flash.rules)
 * 1:39285 <-> ENABLED <-> FILE-FLASH Adobe Flash Player loadSound use after free attempt (file-flash.rules)
 * 1:39286 <-> ENABLED <-> FILE-FLASH Adobe Flash Player loadSound use after free attempt (file-flash.rules)
 * 1:39287 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:39288 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:39302 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ExecPolicy invalid string table lookup attempt (file-flash.rules)
 * 1:39290 <-> ENABLED <-> FILE-FLASH Adobe Flash Player Primetime SDK ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:39291 <-> ENABLED <-> FILE-FLASH Adobe Flash Player NetConnection object type confusion overflow attempt (file-flash.rules)
 * 1:39292 <-> ENABLED <-> FILE-FLASH Adobe Flash Player NetConnection object type confusion overflow attempt (file-flash.rules)
 * 1:39293 <-> DISABLED <-> FILE-FLASH Adobe Flash Player apphelp.dll dll-load exploit attempt (file-flash.rules)
 * 1:39294 <-> DISABLED <-> FILE-FLASH Adobe Flash Player dbghelp.dll dll-load exploit attempt (file-flash.rules)
 * 1:39295 <-> DISABLED <-> FILE-FLASH Adobe Flash Player apphelp.dll dll-load exploit attempt (file-flash.rules)
 * 1:39296 <-> DISABLED <-> FILE-FLASH Adobe Flash Player dbghelp.dll dll-load exploit attempt (file-flash.rules)
 * 1:39297 <-> ENABLED <-> FILE-FLASH Adobe Flash player retrieveResolvers memory corruption attempt (file-flash.rules)
 * 1:39298 <-> ENABLED <-> FILE-FLASH Adobe Flash player retrieveResolvers memory corruption attempt (file-flash.rules)
 * 1:39301 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ExecPolicy invalid string table lookup attempt (file-flash.rules)
 * 1:39308 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed ATF file length load buffer overflow attempt (file-flash.rules)
 * 1:39313 <-> DISABLED <-> FILE-FLASH Adobe Flash Player malformed Adobe Texture Format image load memory corruption attempt (file-flash.rules)
 * 1:39299 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed regular expression use after free attempt (file-flash.rules)
 * 1:39289 <-> ENABLED <-> FILE-FLASH Adobe Flash Player Primetime SDK ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:39306 <-> ENABLED <-> FILE-FLASH Adobe Flash Player sound object use-after-free attempt (file-flash.rules)
 * 1:39300 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed regular expression use after free attempt (file-flash.rules)
 * 1:39311 <-> ENABLED <-> FILE-FLASH Adobe Flash Player same origin policy security bypass attempt (file-flash.rules)
 * 1:39307 <-> ENABLED <-> FILE-FLASH Adobe Flash Player sound object use-after-free attempt (file-flash.rules)
 * 1:39312 <-> DISABLED <-> FILE-FLASH Adobe Flash Player malformed Adobe Texture Format image load memory corruption attempt (file-flash.rules)
 * 3:39303 <-> ENABLED <-> SERVER-WEBAPP Cisco RV Series Routers command injection attempt (server-webapp.rules)

Modified Rules:


 * 1:21322 <-> DISABLED <-> FILE-FLASH Adobe Acrobat Flash Player version.dll dll-load exploit attempt (file-flash.rules)
 * 1:21319 <-> DISABLED <-> FILE-FLASH Adobe Acrobat Flash Player version.dll dll-load exploit attempt (file-flash.rules)
 * 3:38856 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0149 attack attempt (file-other.rules)
 * 3:38859 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0149 attack attempt (file-other.rules)
 * 3:38858 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0149 attack attempt (file-other.rules)
 * 3:38857 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0149 attack attempt (file-other.rules)

2980

2016-06-17 00:36:59 UTC

Snort Subscriber Rules Update

Date: 2016-06-16

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2980.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:39264 <-> DISABLED <-> FILE-FLASH Adobe Flash Player unhandled recursion limit out of bounds read attempt (file-flash.rules)
 * 1:39318 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimOpportunityGenerator out of bounds memory access attempt (file-flash.rules)
 * 1:39319 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimOpportunityGenerator out of bounds memory access attempt (file-flash.rules)
 * 1:39316 <-> ENABLED <-> FILE-FLASH Adobe Flash Player MovieClip object use-after-free attempt (file-flash.rules)
 * 1:39310 <-> ENABLED <-> FILE-FLASH Adobe Flash Player same origin policy security bypass attempt (file-flash.rules)
 * 1:39315 <-> DISABLED <-> FILE-FLASH Adobe Flash Player RegExp numbered backreference out of bounds read attempt (file-flash.rules)
 * 1:39309 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed ATF file length load buffer overflow attempt (file-flash.rules)
 * 1:39314 <-> DISABLED <-> FILE-FLASH Adobe Flash Player RegExp numbered backreference out of bounds read attempt (file-flash.rules)
 * 1:39317 <-> ENABLED <-> FILE-FLASH Adobe Flash Player MovieClip object use-after-free attempt (file-flash.rules)
 * 1:39262 <-> DISABLED <-> FILE-FLASH Adobe Flash Player unhandled recursion limit out of bounds read attempt (file-flash.rules)
 * 1:39263 <-> DISABLED <-> FILE-FLASH Adobe Flash Player unhandled recursion limit out of bounds read attempt (file-flash.rules)
 * 1:39265 <-> DISABLED <-> FILE-FLASH Adobe Flash Player unhandled recursion limit out of bounds read attempt (file-flash.rules)
 * 1:39268 <-> DISABLED <-> SERVER-WEBAPP Joomla PayPlans Extension com_payplans group_id SQL injection attempt (server-webapp.rules)
 * 1:39269 <-> ENABLED <-> FILE-FLASH Adobe Flash TextFormat.setTabStops use-after-free attempt (file-flash.rules)
 * 1:39270 <-> ENABLED <-> FILE-FLASH Adobe Flash TextFormat.setTabStops use-after-free attempt (file-flash.rules)
 * 1:39271 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimContentFactory uninitialized pointer use attempt (file-flash.rules)
 * 1:39272 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimContentFactory uninitialized pointer use attempt (file-flash.rules)
 * 1:39273 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed ATF heap overflow attempt (file-flash.rules)
 * 1:39274 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed ATF heap overflow attempt (file-flash.rules)
 * 1:39275 <-> ENABLED <-> FILE-FLASH Adobe Flash Player loadSound use after free attempt (file-flash.rules)
 * 1:39276 <-> ENABLED <-> FILE-FLASH Adobe Flash Player loadSound use after free attempt (file-flash.rules)
 * 1:39277 <-> ENABLED <-> FILE-OTHER Adobe Flash Player malformed JPEG XR heap overflow attempt (file-other.rules)
 * 1:39278 <-> ENABLED <-> FILE-OTHER Adobe Flash Player malformed JPEG XR heap overflow attempt (file-other.rules)
 * 1:39279 <-> ENABLED <-> FILE-FLASH Adobe Primetime SDK object type confusion overflow attempt (file-flash.rules)
 * 1:39280 <-> ENABLED <-> FILE-FLASH Adobe Primetime SDK object type confusion overflow attempt (file-flash.rules)
 * 1:39281 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed JPEG-XR out of bounds memory access attempt (file-flash.rules)
 * 1:39282 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed JPEG-XR out of bounds memory access attempt (file-flash.rules)
 * 1:39283 <-> ENABLED <-> FILE-FLASH Adobe Flash Player loadSound use after free attempt (file-flash.rules)
 * 1:39284 <-> ENABLED <-> FILE-FLASH Adobe Flash Player loadSound use after free attempt (file-flash.rules)
 * 1:39285 <-> ENABLED <-> FILE-FLASH Adobe Flash Player loadSound use after free attempt (file-flash.rules)
 * 1:39286 <-> ENABLED <-> FILE-FLASH Adobe Flash Player loadSound use after free attempt (file-flash.rules)
 * 1:39287 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:39288 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:39289 <-> ENABLED <-> FILE-FLASH Adobe Flash Player Primetime SDK ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:39290 <-> ENABLED <-> FILE-FLASH Adobe Flash Player Primetime SDK ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:39291 <-> ENABLED <-> FILE-FLASH Adobe Flash Player NetConnection object type confusion overflow attempt (file-flash.rules)
 * 1:39292 <-> ENABLED <-> FILE-FLASH Adobe Flash Player NetConnection object type confusion overflow attempt (file-flash.rules)
 * 1:39313 <-> DISABLED <-> FILE-FLASH Adobe Flash Player malformed Adobe Texture Format image load memory corruption attempt (file-flash.rules)
 * 1:39294 <-> DISABLED <-> FILE-FLASH Adobe Flash Player dbghelp.dll dll-load exploit attempt (file-flash.rules)
 * 1:39295 <-> DISABLED <-> FILE-FLASH Adobe Flash Player apphelp.dll dll-load exploit attempt (file-flash.rules)
 * 1:39296 <-> DISABLED <-> FILE-FLASH Adobe Flash Player dbghelp.dll dll-load exploit attempt (file-flash.rules)
 * 1:39297 <-> ENABLED <-> FILE-FLASH Adobe Flash player retrieveResolvers memory corruption attempt (file-flash.rules)
 * 1:39298 <-> ENABLED <-> FILE-FLASH Adobe Flash player retrieveResolvers memory corruption attempt (file-flash.rules)
 * 1:39299 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed regular expression use after free attempt (file-flash.rules)
 * 1:39300 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed regular expression use after free attempt (file-flash.rules)
 * 1:39301 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ExecPolicy invalid string table lookup attempt (file-flash.rules)
 * 1:39302 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ExecPolicy invalid string table lookup attempt (file-flash.rules)
 * 1:39305 <-> ENABLED <-> FILE-FLASH Adobe Flash Player Primetime SDK ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:39306 <-> ENABLED <-> FILE-FLASH Adobe Flash Player sound object use-after-free attempt (file-flash.rules)
 * 1:39304 <-> ENABLED <-> FILE-FLASH Adobe Flash Player Primetime SDK ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:39293 <-> DISABLED <-> FILE-FLASH Adobe Flash Player apphelp.dll dll-load exploit attempt (file-flash.rules)
 * 1:39311 <-> ENABLED <-> FILE-FLASH Adobe Flash Player same origin policy security bypass attempt (file-flash.rules)
 * 1:39308 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed ATF file length load buffer overflow attempt (file-flash.rules)
 * 1:39307 <-> ENABLED <-> FILE-FLASH Adobe Flash Player sound object use-after-free attempt (file-flash.rules)
 * 1:39312 <-> DISABLED <-> FILE-FLASH Adobe Flash Player malformed Adobe Texture Format image load memory corruption attempt (file-flash.rules)
 * 3:39303 <-> ENABLED <-> SERVER-WEBAPP Cisco RV Series Routers command injection attempt (server-webapp.rules)

Modified Rules:


 * 1:21319 <-> DISABLED <-> FILE-FLASH Adobe Acrobat Flash Player version.dll dll-load exploit attempt (file-flash.rules)
 * 1:21322 <-> DISABLED <-> FILE-FLASH Adobe Acrobat Flash Player version.dll dll-load exploit attempt (file-flash.rules)
 * 3:38856 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0149 attack attempt (file-other.rules)
 * 3:38859 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0149 attack attempt (file-other.rules)
 * 3:38857 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0149 attack attempt (file-other.rules)
 * 3:38858 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0149 attack attempt (file-other.rules)

2982

2016-06-17 00:36:59 UTC

Snort Subscriber Rules Update

Date: 2016-06-16

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2982.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:39262 <-> DISABLED <-> FILE-FLASH Adobe Flash Player unhandled recursion limit out of bounds read attempt (file-flash.rules)
 * 1:39263 <-> DISABLED <-> FILE-FLASH Adobe Flash Player unhandled recursion limit out of bounds read attempt (file-flash.rules)
 * 1:39264 <-> DISABLED <-> FILE-FLASH Adobe Flash Player unhandled recursion limit out of bounds read attempt (file-flash.rules)
 * 1:39265 <-> DISABLED <-> FILE-FLASH Adobe Flash Player unhandled recursion limit out of bounds read attempt (file-flash.rules)
 * 1:39268 <-> DISABLED <-> SERVER-WEBAPP Joomla PayPlans Extension com_payplans group_id SQL injection attempt (server-webapp.rules)
 * 1:39269 <-> ENABLED <-> FILE-FLASH Adobe Flash TextFormat.setTabStops use-after-free attempt (file-flash.rules)
 * 1:39270 <-> ENABLED <-> FILE-FLASH Adobe Flash TextFormat.setTabStops use-after-free attempt (file-flash.rules)
 * 1:39271 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimContentFactory uninitialized pointer use attempt (file-flash.rules)
 * 1:39272 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimContentFactory uninitialized pointer use attempt (file-flash.rules)
 * 1:39273 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed ATF heap overflow attempt (file-flash.rules)
 * 1:39274 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed ATF heap overflow attempt (file-flash.rules)
 * 1:39275 <-> ENABLED <-> FILE-FLASH Adobe Flash Player loadSound use after free attempt (file-flash.rules)
 * 1:39276 <-> ENABLED <-> FILE-FLASH Adobe Flash Player loadSound use after free attempt (file-flash.rules)
 * 1:39277 <-> ENABLED <-> FILE-OTHER Adobe Flash Player malformed JPEG XR heap overflow attempt (file-other.rules)
 * 1:39278 <-> ENABLED <-> FILE-OTHER Adobe Flash Player malformed JPEG XR heap overflow attempt (file-other.rules)
 * 1:39279 <-> ENABLED <-> FILE-FLASH Adobe Primetime SDK object type confusion overflow attempt (file-flash.rules)
 * 1:39280 <-> ENABLED <-> FILE-FLASH Adobe Primetime SDK object type confusion overflow attempt (file-flash.rules)
 * 1:39281 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed JPEG-XR out of bounds memory access attempt (file-flash.rules)
 * 1:39282 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed JPEG-XR out of bounds memory access attempt (file-flash.rules)
 * 1:39283 <-> ENABLED <-> FILE-FLASH Adobe Flash Player loadSound use after free attempt (file-flash.rules)
 * 1:39284 <-> ENABLED <-> FILE-FLASH Adobe Flash Player loadSound use after free attempt (file-flash.rules)
 * 1:39285 <-> ENABLED <-> FILE-FLASH Adobe Flash Player loadSound use after free attempt (file-flash.rules)
 * 1:39286 <-> ENABLED <-> FILE-FLASH Adobe Flash Player loadSound use after free attempt (file-flash.rules)
 * 1:39287 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:39288 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:39289 <-> ENABLED <-> FILE-FLASH Adobe Flash Player Primetime SDK ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:39290 <-> ENABLED <-> FILE-FLASH Adobe Flash Player Primetime SDK ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:39291 <-> ENABLED <-> FILE-FLASH Adobe Flash Player NetConnection object type confusion overflow attempt (file-flash.rules)
 * 1:39292 <-> ENABLED <-> FILE-FLASH Adobe Flash Player NetConnection object type confusion overflow attempt (file-flash.rules)
 * 1:39293 <-> DISABLED <-> FILE-FLASH Adobe Flash Player apphelp.dll dll-load exploit attempt (file-flash.rules)
 * 1:39294 <-> DISABLED <-> FILE-FLASH Adobe Flash Player dbghelp.dll dll-load exploit attempt (file-flash.rules)
 * 1:39295 <-> DISABLED <-> FILE-FLASH Adobe Flash Player apphelp.dll dll-load exploit attempt (file-flash.rules)
 * 1:39296 <-> DISABLED <-> FILE-FLASH Adobe Flash Player dbghelp.dll dll-load exploit attempt (file-flash.rules)
 * 1:39297 <-> ENABLED <-> FILE-FLASH Adobe Flash player retrieveResolvers memory corruption attempt (file-flash.rules)
 * 1:39298 <-> ENABLED <-> FILE-FLASH Adobe Flash player retrieveResolvers memory corruption attempt (file-flash.rules)
 * 1:39299 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed regular expression use after free attempt (file-flash.rules)
 * 1:39300 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed regular expression use after free attempt (file-flash.rules)
 * 1:39301 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ExecPolicy invalid string table lookup attempt (file-flash.rules)
 * 1:39302 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ExecPolicy invalid string table lookup attempt (file-flash.rules)
 * 1:39304 <-> ENABLED <-> FILE-FLASH Adobe Flash Player Primetime SDK ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:39305 <-> ENABLED <-> FILE-FLASH Adobe Flash Player Primetime SDK ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:39306 <-> ENABLED <-> FILE-FLASH Adobe Flash Player sound object use-after-free attempt (file-flash.rules)
 * 1:39319 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimOpportunityGenerator out of bounds memory access attempt (file-flash.rules)
 * 1:39318 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimOpportunityGenerator out of bounds memory access attempt (file-flash.rules)
 * 1:39317 <-> ENABLED <-> FILE-FLASH Adobe Flash Player MovieClip object use-after-free attempt (file-flash.rules)
 * 1:39316 <-> ENABLED <-> FILE-FLASH Adobe Flash Player MovieClip object use-after-free attempt (file-flash.rules)
 * 1:39315 <-> DISABLED <-> FILE-FLASH Adobe Flash Player RegExp numbered backreference out of bounds read attempt (file-flash.rules)
 * 1:39314 <-> DISABLED <-> FILE-FLASH Adobe Flash Player RegExp numbered backreference out of bounds read attempt (file-flash.rules)
 * 1:39313 <-> DISABLED <-> FILE-FLASH Adobe Flash Player malformed Adobe Texture Format image load memory corruption attempt (file-flash.rules)
 * 1:39312 <-> DISABLED <-> FILE-FLASH Adobe Flash Player malformed Adobe Texture Format image load memory corruption attempt (file-flash.rules)
 * 1:39311 <-> ENABLED <-> FILE-FLASH Adobe Flash Player same origin policy security bypass attempt (file-flash.rules)
 * 1:39309 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed ATF file length load buffer overflow attempt (file-flash.rules)
 * 1:39310 <-> ENABLED <-> FILE-FLASH Adobe Flash Player same origin policy security bypass attempt (file-flash.rules)
 * 1:39308 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed ATF file length load buffer overflow attempt (file-flash.rules)
 * 1:39307 <-> ENABLED <-> FILE-FLASH Adobe Flash Player sound object use-after-free attempt (file-flash.rules)
 * 3:39303 <-> ENABLED <-> SERVER-WEBAPP Cisco RV Series Routers command injection attempt (server-webapp.rules)

Modified Rules:


 * 1:21319 <-> DISABLED <-> FILE-FLASH Adobe Acrobat Flash Player version.dll dll-load exploit attempt (file-flash.rules)
 * 1:21322 <-> DISABLED <-> FILE-FLASH Adobe Acrobat Flash Player version.dll dll-load exploit attempt (file-flash.rules)
 * 3:38857 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0149 attack attempt (file-other.rules)
 * 3:38856 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0149 attack attempt (file-other.rules)
 * 3:38858 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0149 attack attempt (file-other.rules)
 * 3:38859 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0149 attack attempt (file-other.rules)

2983

2016-06-17 00:36:59 UTC

Snort Subscriber Rules Update

Date: 2016-06-16

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2983.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:39319 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimOpportunityGenerator out of bounds memory access attempt (file-flash.rules)
 * 1:39318 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimOpportunityGenerator out of bounds memory access attempt (file-flash.rules)
 * 1:39317 <-> ENABLED <-> FILE-FLASH Adobe Flash Player MovieClip object use-after-free attempt (file-flash.rules)
 * 1:39316 <-> ENABLED <-> FILE-FLASH Adobe Flash Player MovieClip object use-after-free attempt (file-flash.rules)
 * 1:39315 <-> DISABLED <-> FILE-FLASH Adobe Flash Player RegExp numbered backreference out of bounds read attempt (file-flash.rules)
 * 1:39314 <-> DISABLED <-> FILE-FLASH Adobe Flash Player RegExp numbered backreference out of bounds read attempt (file-flash.rules)
 * 1:39313 <-> DISABLED <-> FILE-FLASH Adobe Flash Player malformed Adobe Texture Format image load memory corruption attempt (file-flash.rules)
 * 1:39312 <-> DISABLED <-> FILE-FLASH Adobe Flash Player malformed Adobe Texture Format image load memory corruption attempt (file-flash.rules)
 * 1:39311 <-> ENABLED <-> FILE-FLASH Adobe Flash Player same origin policy security bypass attempt (file-flash.rules)
 * 1:39310 <-> ENABLED <-> FILE-FLASH Adobe Flash Player same origin policy security bypass attempt (file-flash.rules)
 * 1:39309 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed ATF file length load buffer overflow attempt (file-flash.rules)
 * 1:39308 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed ATF file length load buffer overflow attempt (file-flash.rules)
 * 1:39307 <-> ENABLED <-> FILE-FLASH Adobe Flash Player sound object use-after-free attempt (file-flash.rules)
 * 1:39306 <-> ENABLED <-> FILE-FLASH Adobe Flash Player sound object use-after-free attempt (file-flash.rules)
 * 1:39305 <-> ENABLED <-> FILE-FLASH Adobe Flash Player Primetime SDK ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:39304 <-> ENABLED <-> FILE-FLASH Adobe Flash Player Primetime SDK ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:39302 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ExecPolicy invalid string table lookup attempt (file-flash.rules)
 * 1:39301 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ExecPolicy invalid string table lookup attempt (file-flash.rules)
 * 1:39300 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed regular expression use after free attempt (file-flash.rules)
 * 1:39299 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed regular expression use after free attempt (file-flash.rules)
 * 1:39298 <-> ENABLED <-> FILE-FLASH Adobe Flash player retrieveResolvers memory corruption attempt (file-flash.rules)
 * 1:39297 <-> ENABLED <-> FILE-FLASH Adobe Flash player retrieveResolvers memory corruption attempt (file-flash.rules)
 * 1:39296 <-> DISABLED <-> FILE-FLASH Adobe Flash Player dbghelp.dll dll-load exploit attempt (file-flash.rules)
 * 1:39295 <-> DISABLED <-> FILE-FLASH Adobe Flash Player apphelp.dll dll-load exploit attempt (file-flash.rules)
 * 1:39294 <-> DISABLED <-> FILE-FLASH Adobe Flash Player dbghelp.dll dll-load exploit attempt (file-flash.rules)
 * 1:39293 <-> DISABLED <-> FILE-FLASH Adobe Flash Player apphelp.dll dll-load exploit attempt (file-flash.rules)
 * 1:39292 <-> ENABLED <-> FILE-FLASH Adobe Flash Player NetConnection object type confusion overflow attempt (file-flash.rules)
 * 1:39291 <-> ENABLED <-> FILE-FLASH Adobe Flash Player NetConnection object type confusion overflow attempt (file-flash.rules)
 * 1:39290 <-> ENABLED <-> FILE-FLASH Adobe Flash Player Primetime SDK ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:39289 <-> ENABLED <-> FILE-FLASH Adobe Flash Player Primetime SDK ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:39288 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:39287 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:39286 <-> ENABLED <-> FILE-FLASH Adobe Flash Player loadSound use after free attempt (file-flash.rules)
 * 1:39285 <-> ENABLED <-> FILE-FLASH Adobe Flash Player loadSound use after free attempt (file-flash.rules)
 * 1:39284 <-> ENABLED <-> FILE-FLASH Adobe Flash Player loadSound use after free attempt (file-flash.rules)
 * 1:39283 <-> ENABLED <-> FILE-FLASH Adobe Flash Player loadSound use after free attempt (file-flash.rules)
 * 1:39282 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed JPEG-XR out of bounds memory access attempt (file-flash.rules)
 * 1:39281 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed JPEG-XR out of bounds memory access attempt (file-flash.rules)
 * 1:39280 <-> ENABLED <-> FILE-FLASH Adobe Primetime SDK object type confusion overflow attempt (file-flash.rules)
 * 1:39279 <-> ENABLED <-> FILE-FLASH Adobe Primetime SDK object type confusion overflow attempt (file-flash.rules)
 * 1:39278 <-> ENABLED <-> FILE-OTHER Adobe Flash Player malformed JPEG XR heap overflow attempt (file-other.rules)
 * 1:39277 <-> ENABLED <-> FILE-OTHER Adobe Flash Player malformed JPEG XR heap overflow attempt (file-other.rules)
 * 1:39276 <-> ENABLED <-> FILE-FLASH Adobe Flash Player loadSound use after free attempt (file-flash.rules)
 * 1:39275 <-> ENABLED <-> FILE-FLASH Adobe Flash Player loadSound use after free attempt (file-flash.rules)
 * 1:39274 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed ATF heap overflow attempt (file-flash.rules)
 * 1:39273 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed ATF heap overflow attempt (file-flash.rules)
 * 1:39272 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimContentFactory uninitialized pointer use attempt (file-flash.rules)
 * 1:39271 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimContentFactory uninitialized pointer use attempt (file-flash.rules)
 * 1:39270 <-> ENABLED <-> FILE-FLASH Adobe Flash TextFormat.setTabStops use-after-free attempt (file-flash.rules)
 * 1:39269 <-> ENABLED <-> FILE-FLASH Adobe Flash TextFormat.setTabStops use-after-free attempt (file-flash.rules)
 * 1:39268 <-> DISABLED <-> SERVER-WEBAPP Joomla PayPlans Extension com_payplans group_id SQL injection attempt (server-webapp.rules)
 * 1:39265 <-> DISABLED <-> FILE-FLASH Adobe Flash Player unhandled recursion limit out of bounds read attempt (file-flash.rules)
 * 1:39264 <-> DISABLED <-> FILE-FLASH Adobe Flash Player unhandled recursion limit out of bounds read attempt (file-flash.rules)
 * 1:39263 <-> DISABLED <-> FILE-FLASH Adobe Flash Player unhandled recursion limit out of bounds read attempt (file-flash.rules)
 * 1:39262 <-> DISABLED <-> FILE-FLASH Adobe Flash Player unhandled recursion limit out of bounds read attempt (file-flash.rules)
 * 3:39303 <-> ENABLED <-> SERVER-WEBAPP Cisco RV Series Routers command injection attempt (server-webapp.rules)

Modified Rules:


 * 1:21319 <-> DISABLED <-> FILE-FLASH Adobe Acrobat Flash Player version.dll dll-load exploit attempt (file-flash.rules)
 * 1:21322 <-> DISABLED <-> FILE-FLASH Adobe Acrobat Flash Player version.dll dll-load exploit attempt (file-flash.rules)
 * 3:38857 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0149 attack attempt (file-other.rules)
 * 3:38856 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0149 attack attempt (file-other.rules)
 * 3:38859 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0149 attack attempt (file-other.rules)
 * 3:38858 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0149 attack attempt (file-other.rules)